macOS osascript Clipboard Access via AppleScript Commands
Alerts on osascript commands that reference the system clipboard, which may indicate collection or automation misuse on macOS.
- Product
- macos
- Category
- process_creation
- Author
- Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
- Published
- 2023-01-31
- Updated
- 2026-07-31
ATT&CK techniques
Execution → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of osascript on macOS that include AppleScript commands referencing the clipboard, indicating clipboard content access. Attackers can use this capability to collect data from the user’s clipboard or integrate clipboard handling into automation and tooling. It relies on process creation telemetry, matching the osascript binary path and required clipboard-related command-line strings, and excludes a known legitimate automation pattern from a specific parent process.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS osascript Clipboard Access via AppleScript Commands
id: 15e8dbf2-0818-4e4d-9172-ebba1b5f5691
related:
- id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55
type: derived
- id: 7794fa3c-edea-4cff-bec7-267dd4770fd7
type: derived
status: test
description: This rule flags process executions of osascript on macOS that include AppleScript commands referencing the clipboard, indicating clipboard content access. Attackers can use this capability to collect data from the user’s clipboard or integrate clipboard handling into automation and tooling. It relies on process creation telemetry, matching the osascript binary path and required clipboard-related command-line strings, and excludes a known legitimate automation pattern from a specific parent process.
references:
- https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_clipboard_access_via_osascript.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-01-31
modified: 2026-05-22
tags:
- attack.collection
- attack.execution
- attack.t1115
- attack.t1059.002
logsource:
product: macos
category: process_creation
detection:
selection:
Image|endswith: /osascript
CommandLine|contains|all:
- " -e "
- clipboard
filter_optional_opencode:
ParentImage|endswith: opencode
CommandLine|contains|all:
- osascript
- " -e "
- set imageData to the clipboard
- set fileRef
condition: selection and not 1 of filter_optional_*
falsepositives:
- Legitimate clipboard utilities and automation scripts that read or write clipboard content
- Developer tools and IDEs that use osascript for clipboard integration
level: medium
license: DRL-1.1