macOS osascript Clipboard Access via AppleScript

Alerts on osascript commands that reference the system clipboard, which may indicate collection or automation misuse on macOS.

FreeUnreviewedSigmamediumv1

macos-osascript-clipboard-access-via-applescript-7794fa3c

title: macOS osascript Clipboard Access via AppleScript
id: 15e8dbf2-0818-4e4d-9172-ebba1b5f5691
related:
  - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55
    type: derived
  - id: 7794fa3c-edea-4cff-bec7-267dd4770fd7
    type: derived
status: test
description: This rule flags macOS process executions of osascript where the command line includes AppleScript targeting the clipboard. Attackers can use this to collect or exfiltrate data by reading clipboard contents through automation. It relies on process creation telemetry, matching the osascript executable path and clipboard-related AppleScript parameters in the command line, while excluding a known opencode automation parent process.
references:
  - https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_clipboard_access_via_osascript.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-01-31
modified: 2026-05-22
tags:
  - attack.collection
  - attack.execution
  - attack.t1115
  - attack.t1059.002
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /osascript
    CommandLine|contains|all:
      - " -e "
      - clipboard
  filter_optional_opencode:
    ParentImage|endswith: opencode
    CommandLine|contains|all:
      - osascript
      - " -e "
      - set imageData to the clipboard
      - set fileRef
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate clipboard utilities and automation scripts that read or write clipboard content
  - Developer tools and IDEs that use osascript for clipboard integration
level: medium
license: DRL-1.1

What it detects

This rule flags macOS process executions of osascript where the command line includes AppleScript targeting the clipboard. Attackers can use this to collect or exfiltrate data by reading clipboard contents through automation. It relies on process creation telemetry, matching the osascript executable path and clipboard-related AppleScript parameters in the command line, while excluding a known opencode automation parent process.

Known false positives

Legitimate clipboard utilities and automation scripts that read or write clipboard content
Developer tools and IDEs that use osascript for clipboard integration

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.