T1059.002 AppleScript
Sub-technique of T1059 Command and Scripting Interpreter
Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- JXA In-memory Execution Via OSAScripthightest · macos
- OSACompile Run-Only Executionhightest · macos
- Suspicious Microsoft Office Child Process - MacOShightest · macos
- Atomic MacOS Stealer - FileGrabber Activityhighexperimental · macos
- Axios NPM Compromise Indicators - macOShighexperimental · macos
- Clipboard Access Via OSAScriptmediumtest · macos
- MacOS Scripting Interpreter AppleScriptmediumtest · macos
- Osacompile Execution By Potentially Suspicious Applet/Osascriptmediumtest · macos
- Suspicious Execution via macOS Script Editormediumtest · macos
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.