Techniques
Sample rules
MacOS Osascript Displaying Suspicious User Prompt
- source: splunk
- technicques:
Description
The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content. Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information. This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Processes WHERE
Processes.process_name="osascript"
Processes.process IN (
"*display alert*",
"*display dialog*"
)
Processes.process IN (
"*access System*",
"*authentication*",
"*credentials*",
"*critical update*",
"*needs your attention*",
"*password*",
"*security update*",
"*system error*",
"*verify*",
"*with hidden answer*"
)
BY Processes.dest Processes.original_file_name Processes.parent_process_id
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id
Processes.process_current_directory Processes.process_name
Processes.process_path Processes.user
Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `macos_osascript_displaying_suspicious_user_prompt_filter`