Techniques
Sample rules
MacOS AppleScript Shell Execution and Compilation
- source: splunk
- technicques:
Description
The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic.
The analytic identifies osascript invocations using AppleScript’s do shell script command, which executes shell commands on the host.
It also identifies osacompile invocations referencing do shell script. osacompile compiles AppleScript into a compiled script but does not execute it directly.
Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving osacompile should be interpreted as script compilation or staging rather than confirmed shell-command execution.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Processes WHERE
Processes.process_name IN ("osascript", "osacompile")
Processes.process="*do *"
Processes.process="* shell *"
Processes.process="* script*"
BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user
Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| eval activity_type=case(
process_name="osascript", "AppleScript Shell Command Execution",
process_name="osacompile", "AppleScript Compilation or Staging"
)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product
| `macos_applescript_shell_execution_and_compilation_filter`