BIOC Informational

Microsoft Office spawns curl/wget on a macOS device

Microsoft Office Word/Excel/PowerPoint/Outlook spawn wget/curl on a macOS device.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Exfiltration
Status:
Enabled
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003)
Indicator:

Process action type = execution AND target process name = curl , wget Process initiated by = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook , cgo name = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook , os parent name = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook

Preventable: yes