Techniques
Sample rules
Clipboard Access Via OSAScript
- source: sigma
- technicques:
- t1059
- t1059.002
- t1115
Description
Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts
Detection logic
condition: selection and not 1 of filter_optional_*
filter_optional_opencode:
CommandLine|contains|all:
- osascript
- ' -e '
- set imageData to the clipboard
- set fileRef
ParentImage|endswith: opencode
selection:
CommandLine|contains|all:
- ' -e '
- clipboard
Image|endswith: /osascript