rules/macos/process_creation/proc_creation_macos_applescript.yml

title: MacOS Scripting Interpreter AppleScript
id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55
status: test
description: Detects execution of AppleScript of the macOS scripting language AppleScript.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md
    - https://redcanary.com/blog/applescript/
author: Alejandro Ortuno, oscd.community
date: 2020-10-21
modified: 2023-02-01
tags:
    - attack.execution
    - attack.t1059.002
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/osascript'
        CommandLine|contains:
            - ' -e '
            - '.scpt'
            - '.js'
    condition: selection
falsepositives:
    - Application installers might contain scripts as part of the installation process.
level: medium
Initial sigma rule 2020-10-21 10:09:00 +02:00			`title: MacOS Scripting Interpreter AppleScript`
			`id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`description: Detects execution of AppleScript of the macOS scripting language AppleScript.`
			`references:`
Update Ref+Selection 2022-07-11 14:11:53 +01:00			`- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md`
fix: add reference 2023-02-01 17:15:10 +01:00			`- https://redcanary.com/blog/applescript/`
$frack113$ Order yaml field 4 (#3628 ) 2022-10-25 09:30:05 +02:00			`author: Alejandro Ortuno, oscd.community`
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes 2024-08-12 12:02:50 +02:00			`date: 2020-10-21`
			`modified: 2023-02-01`
$frack113$ Order yaml field 4 (#3628 ) 2022-10-25 09:30:05 +02:00			`tags:`
			`- attack.execution`
			`- attack.t1059.002`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`logsource:`
Update Ref+Selection 2022-07-11 14:11:53 +01:00			`category: process_creation`
			`product: macos`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`detection:`
fix: add reference 2023-02-01 17:15:10 +01:00			`selection:`
Update Ref+Selection 2022-07-11 14:11:53 +01:00			`Image\|endswith: '/osascript'`
fix: add reference 2023-02-01 17:15:10 +01:00			`CommandLine\|contains:`
			`- ' -e '`
Update proc_creation_macos_applescript.yml 2023-01-31 19:16:15 +05:30			`- '.scpt'`
$frack113$ Update from review 2023-02-01 18:30:45 +01:00			`- '.js'`
fix: add reference 2023-02-01 17:15:10 +01:00			`condition: selection`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`falsepositives:`
Update Ref+Selection 2022-07-11 14:11:53 +01:00			`- Application installers might contain scripts as part of the installation process.`
Initial sigma rule 2020-10-21 10:09:00 +02:00			`level: medium`