rules/macos/process_creation/proc_creation_macos_applescript.yml

title: MacOS Scripting Interpreter AppleScript
id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55
status: test
description: Detects execution of AppleScript of the macOS scripting language AppleScript.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md
author: Alejandro Ortuno, oscd.community
date: 2020/10/21
modified: 2021/11/27
tags:
    - attack.execution
    - attack.t1059.002
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/osascript'
        CommandLine|contains: '-e'
    condition: selection
falsepositives:
    - Application installers might contain scripts as part of the installation process.
level: medium
Initial sigma rule 2020-10-21 10:09:00 +02:00			`title: MacOS Scripting Interpreter AppleScript`
			`id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`description: Detects execution of AppleScript of the macOS scripting language AppleScript.`
			`references:`
Update Ref+Selection 2022-07-11 14:11:53 +01:00			`- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md`
$frack113$ Order yaml field 4 (#3628 ) 2022-10-25 09:30:05 +02:00			`author: Alejandro Ortuno, oscd.community`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`date: 2020/10/21`
			`modified: 2021/11/27`
$frack113$ Order yaml field 4 (#3628 ) 2022-10-25 09:30:05 +02:00			`tags:`
			`- attack.execution`
			`- attack.t1059.002`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`logsource:`
Update Ref+Selection 2022-07-11 14:11:53 +01:00			`category: process_creation`
			`product: macos`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`detection:`
Update Ref+Selection 2022-07-11 14:11:53 +01:00			`selection:`
			`Image\|endswith: '/osascript'`
			`CommandLine\|contains: '-e'`
			`condition: selection`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`falsepositives:`
Update Ref+Selection 2022-07-11 14:11:53 +01:00			`- Application installers might contain scripts as part of the installation process.`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`level: medium`