nscurl

Download file and ignore cert checking

nscurl -k https://google.com -o /private/tmp/google

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Defense Evasion, Command and Control

Detection

Jamf Protect: Detect all curl and nscurl activity: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity

Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure

Sigma: File Download Via Nscurl - MacOS: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nscurl.yml

www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl

danielcortez.substack.com/p/living-off-the-land-exploring-macos

Download file to the Downloads directory using -dl

nscurl https://google.com -dl

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Defense Evasion, Command and Control

Detection

Jamf Protect: Detect all curl and nscurl activity: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity

Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure

Sigma: File Download Via Nscurl - MacOS: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nscurl.yml

www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl

danielcortez.substack.com/p/living-off-the-land-exploring-macos

Download file to a designated directory using -dir

nscurl https://google.com -dir /private/tmp/google

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Defense Evasion, Command and Control

Detection

Jamf Protect: Detect all curl and nscurl activity: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity

Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure

Sigma: File Download Via Nscurl - MacOS: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nscurl.yml

www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl

danielcortez.substack.com/p/living-off-the-land-exploring-macos