AN0518: Analytic 0518
Detect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.
Analyst context for executives and security teams
This analytic matters because it focuses on a practical macOS warning sign: executable files being pulled into user directories with tools such as scp, rsync, curl, or third-party sync applications and then run soon after. For leaders, the value is not the tool names themselves—these utilities can be legitimate—but whether the organization can distinguish normal user file transfer activity from suspicious delivery-and-execution behavior on macOS endpoints.
Executive priority
Prioritize this as a macOS endpoint and SOC readiness question: do teams have enough endpoint and file-event visibility to prove when executables are newly created in user-controlled locations and immediately executed? This supports incident triage, managed detection validation, audit evidence for endpoint monitoring, and control prioritization around user directory execution risk. Because ATT&CK provides no tactic mapping or relationship context for this analytic, treat it as a coverage validation item rather than evidence of a specific campaign or threat actor.
Technical view
For SOC, detection engineering, and IR teams, validate correlation logic on macOS that links file creation in user directories to near-term process execution, with attention to scp, rsync, curl, and third-party sync applications as possible transfer sources. The analytic should be tested against legitimate administrative workflows, developer activity, software update patterns, and sync-client behavior to reduce false positives. Since no official detection logic is supplied, local teams must define user directory scope, executable file criteria, timing windows, and allowlist strategy based on their environment.
Likely telemetry
- macOS process execution events including command name, path, arguments, parent process, user, and timestamp
- macOS file creation events in user directories, including file path, file type or executable metadata, user, and timestamp
- Network or process telemetry showing use of scp, rsync, curl, or third-party sync applications
- Endpoint security or EDR events that can correlate newly written files with immediate execution
- Asset and user context to distinguish managed administrative activity from unusual user-level execution
Detection direction
- Confirm that macOS endpoints generate both file creation and process execution telemetry with timestamps precise enough for correlation.
- Tune for executable files created in user directories followed by immediate execution, rather than alerting on all scp, rsync, curl, or sync-client usage.
- Establish environment-specific baselines for developer tools, IT administration, automation, and approved sync applications to reduce false positives.
- Review blind spots where user directory file writes are not captured, third-party sync application activity is opaque, or command-line arguments are unavailable.
- Because no ATT&CK relationships or tactic mapping are supplied, avoid overclassifying alerts; use this analytic as a behavioral lead requiring enrichment.
Mitigation priorities
- Ensure macOS endpoint monitoring captures file creation and execution activity in user directories.
- Define policy expectations for executing newly downloaded or synchronized files from user-controlled paths.
- Restrict or govern unapproved third-party sync applications where business policy allows.
- Use application control, endpoint hardening, and user privilege management where appropriate to reduce risky execution from user directories.
- Document detection coverage and known gaps for compliance, incident response readiness, and managed detection handoff.
Analyst notes and limits
This take is based only on ATT&CK analytic AN0518 for macOS. The object describes a detection idea but does not provide an official detection query, tactic mapping, related techniques, or relationship context. The main defensive value is validating whether local telemetry can correlate transfer-associated file creation with immediate execution in user directories.
The supplied ATT&CK fields do not support claims about active exploitation, adversary attribution, prevalence, impact, or guaranteed detection. Local environment data is required to define timing thresholds, executable identification, approved tools, user directory scope, and false-positive handling.
Analytic 0518
Detect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | f5005c27db8b… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0518Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.