# nscurl

> Download, upload, and read files.

macOS version of curl that is used to download files to a target without applying the quarantine extended attribute

- Page: https://loobins.io/binaries/nscurl/
- Author: Leo Pitt (@_D00mfist)
- Created: 2023-05-22
- Tactics: Defense Evasion, Command and Control

## Paths

- `/usr/bin/nscurl`

## Example Use Cases

### Download file

Download file and ignore cert checking

```bash
nscurl -k https://google.com -o /private/tmp/google
```

- Tactics: Defense Evasion, Command and Control

### Download file

Download file to the Downloads directory using -dl

```bash
nscurl https://google.com -dl
```

- Tactics: Defense Evasion, Command and Control

### Download file

Download file to a designated directory using -dir

```bash
nscurl https://google.com -dir /private/tmp/google
```

- Tactics: Defense Evasion, Command and Control

## Detections

- [Jamf Protect: Detect all curl and nscurl activity](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity)
- [Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure)
- [Sigma: File Download Via Nscurl - MacOS](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml)

## Resources

- [How to Diagnose App Transport Security Issues using nscurl and OpenSSL](https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl)
- [Living-off-the-Land: Exploring macOS LOOBins and Crafting Detection Rules - nscurl](https://danielcortez.substack.com/p/living-off-the-land-exploring-macos)