macOS: Detect applet/osascript execution of osacompile via process command line

title: "macOS: Detect applet/osascript execution of osacompile via process command line"
id: a0c77cf5-1871-4534-a9d5-d6ecb2e2424d
status: test
description: This rule identifies macOS process creations where a parent image ending in /applet or /osascript runs a command line containing "osacompile". Attackers can use AppleScript/Applet execution chains to compile and deploy additional payloads, making this behavior an important execution indicator. The detection relies on process creation telemetry capturing the parent image path and the child process command line content.
references:
  - https://redcanary.com/blog/mac-application-bundles/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_suspicious_applet_behaviour.yml
author: Sohan G (D4rkCiph3r), Red Canary (Idea), Huntrule Team
date: 2023-04-03
tags:
  - attack.execution
  - attack.t1059.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith:
      - /applet
      - /osascript
    CommandLine|contains: osacompile
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a753a6af-3126-426d-8bd0-26ebbcb92254
    type: derived