macOS: osascript display dialog prompts for credential capture

Flags osascript command lines that script system dialogs referencing authentication and password-related terms.

FreeUnreviewedSigmalowv1

macos-osascript-display-dialog-prompts-for-credential-capture-60f1ce20

title: "macOS: osascript display dialog prompts for credential capture"
id: 1fd0ebd8-4b25-45ba-8d22-b613538a2d6d
status: test
description: This rule flags macOS process executions of osascript where command lines include display/dialog prompt scripting and terms commonly associated with authentication and passwords. Attackers can use system dialog prompts to trick users into entering sensitive credentials outside of normal application flows. The detection relies on process creation telemetry capturing the executed image path and the command-line arguments used to script the dialog behavior.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md
  - https://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2025-12-05
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.002
logsource:
  product: macos
  category: process_creation
detection:
  selection_img:
    Image|endswith: /osascript
  selection_cli_1:
    CommandLine|contains|all:
      - -e
      - display
      - dialog
      - answer
  selection_cli_2:
    CommandLine|contains:
      - admin
      - administrator
      - authenticate
      - authentication
      - credentials
      - pass
      - password
      - unlock
  condition: all of selection_*
falsepositives:
  - Legitimate administration tools and activities
level: low
license: DRL-1.1
related:
  - id: 60f1ce20-484e-41bd-85f4-ac4afec2c541
    type: derived

What it detects

This rule flags macOS process executions of osascript where command lines include display/dialog prompt scripting and terms commonly associated with authentication and passwords. Attackers can use system dialog prompts to trick users into entering sensitive credentials outside of normal application flows. The detection relies on process creation telemetry capturing the executed image path and the command-line arguments used to script the dialog behavior.

Known false positives

Legitimate administration tools and activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.