nscurl #

Created by Leo Pitt (@_D00mfist)

Description ##

macOS version of curl that is used to download files to a target without applying the quarantine extended attribute

Paths ##

• /usr/bin/nscurl

Use Cases ##

Download file ##

Download file and ignore cert checking

nscurl -k https://google.com -o /private/tmp/google

Download file ##

Download file to the Downloads directory using -dl

nscurl https://google.com -dl

Download file ##

Download file to a designated directory using -dir

nscurl https://google.com -dir /private/tmp/google

Detections ##

• Jamf Protect: Detect all curl and nscurl activity

• Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl

• Sigma: File Download Via Nscurl - MacOS

Resources ##

• How to Diagnose App Transport Security Issues using nscurl and OpenSSL

• Living-off-the-Land: Exploring macOS LOOBins and Crafting Detection Rules - nscurl