Merge pull request SigmaHQ#4127 from D4rkCiph3r/in-memory-payload

Create proc_creation_macos_in-memory_payload_transfer.yml

rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml

@@ -0,0 +1,25 @@
+title: Potential In-Memory Download And Compile Of Payloads
+id: 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
+status: experimental
+description: Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
+references:
+    - https://redcanary.com/blog/mac-application-bundles/
+author: Sohan G (D4rkCiph3r), Red Canary (idea)
+date: 2023/08/22
+tags:
+    - attack.command_and_control
+    - attack.execution
+    - attack.t1059.007
+    - attack.t1105
+logsource:
+    category: process_creation
+    product: macos
+detection:
+    selection:
+        CommandLine|contains|all:
+            - 'osacompile'
+            - 'curl'
+    condition: selection
+falsepositives:
+    - Unknown
+level: medium