Techniques
Sample rules
MacOS Scripting Interpreter AppleScript
- source: sigma
- technicques:
- t1059
- t1059.002
Description
Detects execution of AppleScript of the macOS scripting language AppleScript.
Detection logic
condition: selection and not 1 of filter_optional_*
filter_optional_opencode:
CommandLine|contains|all:
- osascript
- ' -e '
- set imageData to the clipboard
- set fileRef
ParentImage|endswith: opencode
selection:
CommandLine|contains:
- ' -e '
- .scpt
- .js
Image|endswith: /osascript