Detection of External IP Discovery via Curl on macOS

Adversaries targeting macOS endpoints frequently engage in reconnaissance to identify the victim's external-facing IP address and network environment. This process is commonly automated by scripts or dropped binaries that invoke the built-in curl or nscurl utilities to query various public "what is my IP" and geolocation services. By understanding the host's external network context, attackers can tailor subsequent C2 communications, routing, or staging decisions based on the target's geography or ISP. This behavior is often observed originating from unsigned processes, temporary file locations (e.g., /private/var/folders), or suspicious parent shell processes (bash/zsh) containing network-related command line arguments. Identifying this activity early can help defenders block unauthorized reconnaissance before deeper persistence or data exfiltration occurs.

Impact

Successful reconnaissance allows attackers to map the network infrastructure of the target, increasing the likelihood of successful C2 establishment and targeted exploitation. While the discovery action itself is low-impact, it is a precursor to more severe activities such as credential theft, lateral movement, and unauthorized exfiltration, potentially affecting any enterprise environment where macOS endpoints are present.

Recommendation

• Deploy the provided Sigma rule to monitor for suspicious curl executions; tune for administrative diagnostic scripts and known legitimate telemetry tools used in the environment.
• Monitor process-creation events for curl or nscurl spawned by untrusted or unsigned parent applications.
• Block egress access to known public IP lookup domains (e.g., ipify.org, ipinfo.io) from unauthorized or suspicious processes at the network edge or DNS resolver.
• Review endpoints for indicators of persistence (e.g., LaunchAgents, cron jobs) if suspicious IP discovery is confirmed, as this often indicates an active infection stage.