T1059.002 AppleScript
Subtécnica de T1059 Command and Scripting Interpreter
Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- JXA In-memory Execution Via OSAScripthightest · macos
- OSACompile Run-Only Executionhightest · macos
- Suspicious Microsoft Office Child Process - MacOShightest · macos
- Atomic MacOS Stealer - FileGrabber Activityhighexperimental · macos
- Axios NPM Compromise Indicators - macOShighexperimental · macos
- Clipboard Access Via OSAScriptmediumtest · macos
- MacOS Scripting Interpreter AppleScriptmediumtest · macos
- Osacompile Execution By Potentially Suspicious Applet/Osascriptmediumtest · macos
- Suspicious Execution via macOS Script Editormediumtest · macos
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.