Inventory MacSync request-shape pivots
Finding
The initial search groups retrieval, check-in, and upload request-shape pivots across rotating destinations.
Multiple aligned request traits are more useful than a domain match by itself.
View query
Q-01First searchInventory MacSync request-shape pivots
What this checks
Identify macOS curl network activity carrying recurring retrieval, check-in, or chunked upload request shapes across all domains.
KQL
let mac_devices =
DeviceInfo
| where Timestamp >= ago(7d)
| summarize arg_max(Timestamp, DeviceName, OSPlatform) by DeviceId
| where OSPlatform startswith "macOS"
| project DeviceId, OSPlatform;
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName =~ "curl"
| where RemoteUrl has_any ("/curl/", "/dynamic?txd=", "/gate?buildtxd=", "upload_id=", "chunk_index=", "total_chunks=")
| join kind=inner mac_devices on DeviceId
| extend Pivot=case(
RemoteUrl has "/gate?buildtxd=" or RemoteUrl has "upload_id=", "chunked-upload",
RemoteUrl has "/dynamic?txd=", "check-in",
RemoteUrl has "/curl/", "payload-retrieval",
"other"
)
| summarize
FirstSeen=min(Timestamp),
LastSeen=max(Timestamp),
Connections=count(),
Pivots=make_set(Pivot,10),
Destinations=make_set(RemoteUrl,100),
RemoteIPs=make_set(RemoteIP,50),
Commands=make_set(InitiatingProcessCommandLine,50),
Users=make_set(InitiatingProcessAccountUpn,20)
by DeviceId,DeviceName,OSPlatform
| order by Connections descSPL
(
index=<endpoint_network_index> sourcetype=<endpoint_network_events_sourcetype> earliest=-30d
)
OR
(
index=<device_inventory_index> sourcetype=<device_info_sourcetype> earliest=-7d
)
| eval
device_id=coalesce(device_id,DeviceId),
device=coalesce(device,DeviceName,host),
os=coalesce(os,OSPlatform),
process_name=lower(coalesce(process_name,InitiatingProcessFileName)),
remote_url=coalesce(remote_url,RemoteUrl),
cmd=coalesce(cmd,InitiatingProcessCommandLine),
pivot=case(
like(remote_url,"%/gate?buildtxd=%") OR like(remote_url,"%upload_id=%"),"chunked-upload",
like(remote_url,"%/dynamic?txd=%"),"check-in",
like(remote_url,"%/curl/%"),"payload-retrieval",
true(),"other"
)
| eventstats latest(OSPlatform) as os_platform by device_id
| where like(lower(os_platform),"macos%")
AND process_name="curl"
AND pivot!="other"
| stats min(_time) as first_seen max(_time) as last_seen count as connections
values(pivot) as pivots values(remote_url) as destinations
values(RemoteIP) as remote_ips values(cmd) as commands values(InitiatingProcessAccountUpn) as users
by device_id device os_platform
| convert ctime(first_seen) ctime(last_seen)
| sort - connectionsWhat to look for
A ranked set of Macs and destinations matching one or more durable request-shape pivots.
Technical details
Tested signal
curl network activity with recurring MacSync URI paths or upload parameters.
Assumptions
- DeviceInfo and DeviceNetworkEvents are available for at least thirty days.
- The query intentionally treats domains as enrichment rather than the primary selector.
Data requirements and relevant fields
- endpoint
Device inventory used to restrict analytics to current macOS endpoints.
TimestampDeviceIdDeviceNameOSPlatform
- network
Endpoint network telemetry with destination URL, port, initiating process, user, and stable process identity.
TimestampDeviceIdDeviceNameRemoteUrlRemoteIPRemotePortProtocolLocalIPLocalPortInitiatingProcessFileNameInitiatingProcessFolderPathInitiatingProcessCommandLineInitiatingProcessAccountNameInitiatingProcessAccountUpnInitiatingProcessUniqueId
KQL schema
Validate Defender for Endpoint coverage on macOS, table availability, field population, and retention before operational use.
SPL schema
Replace index/sourcetype placeholders and map device, process, file, and network fields to local telemetry.
Limitations
- Legitimate applications can use curl and individual URI fragments; multiple aligned traits raise confidence.
KQL uses Microsoft Defender XDR endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.