huntrule

macOS JXA In-Memory JavaScript Execution via OSAScript

Detects osascript-launched in-memory JXA JavaScript execution patterns using eval and URL-based data loading.

FreeUnreviewedSigmahighv1
title: macOS JXA In-Memory JavaScript Execution via OSAScript
id: 366e0aeb-72db-476a-b64a-9cc1bc1c5ee0
related:
  - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55
    type: derived
  - id: f1408a58-0e94-4165-b80a-da9f96cf6fc3
    type: derived
status: test
description: This rule flags macOS process executions where osascript is invoked with parameters consistent with JXA in-memory JavaScript evaluation. Attackers can use this pattern to execute JavaScript without writing a script file, making execution harder to spot on disk. The detection relies on process command-line telemetry, matching for osascript usage with eval and NSData data retrieval, as well as JavaScript indicators.
references:
  - https://redcanary.com/blog/applescript/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-01-31
tags:
  - attack.t1059.002
  - attack.t1059.007
  - attack.execution
logsource:
  product: macos
  category: process_creation
detection:
  selection_main:
    CommandLine|contains|all:
      - osascript
      - " -e "
      - eval
      - NSData.dataWithContentsOfURL
  selection_js:
    - CommandLine|contains|all:
        - " -l "
        - JavaScript
    - CommandLine|contains: .js
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags macOS process executions where osascript is invoked with parameters consistent with JXA in-memory JavaScript evaluation. Attackers can use this pattern to execute JavaScript without writing a script file, making execution harder to spot on disk. The detection relies on process command-line telemetry, matching for osascript usage with eval and NSData data retrieval, as well as JavaScript indicators.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.