The SuspiciousCurlCommand analytic detects suspicious activity where the curl utility is used to pass scripting code directly from a download event to a script interpreter where it may be compiled or executed without first writing to disk.
curl is a built-in command-line utility on macOS that is used for easily transferring data to or from the host computer, with the ability to pass downloaded data (such as scripting code) directly to other utilities on device and without writing to disk. When such activity occurs within memory and without writing to disk, traditional file-based signature detection methods are ineffective and activity may go undetected.
This technique was observed in use by the XCSSET malware family recently discovered, whereby the malware leveraged curl to compile and execute downloaded scripts directly in memory. This detection will monitor the execution of curl and will trigger an alert when a curl output is piped into an interpreter language such as AppleScript. This is considered suspicious behavior for curl and can be an indication of malicious activity since the remote script is being executed directly in memory.
For more information about this type of threat see MITRE ATT&CK Tactic: Command and Control and MITRE ATT&CK Technique: Ingress Tool Transfer.