macOS GUI Credential Prompt Capture via osascript
Flags osascript command lines that script system dialogs referencing authentication and password-related terms.
- Product
- macos
- Category
- process_creation
- Author
- remotephone, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-13
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of osascript that use AppleScript dialog prompts (display dialog) and include keywords related to authentication and credentials. Attackers may use system dialogs to solicit or capture sensitive information from users. It relies on macOS process creation telemetry, specifically the executed image path ending with /osascript and the command-line arguments used.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md
- scriptingosx.comhttps://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS GUI Credential Prompt Capture via osascript
id: 1fd0ebd8-4b25-45ba-8d22-b613538a2d6d
status: test
description: This rule flags process executions of osascript that use AppleScript dialog prompts (display dialog) and include keywords related to authentication and credentials. Attackers may use system dialogs to solicit or capture sensitive information from users. It relies on macOS process creation telemetry, specifically the executed image path ending with /osascript and the command-line arguments used.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md
- https://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2025-12-05
tags:
- attack.collection
- attack.credential-access
- attack.t1056.002
logsource:
product: macos
category: process_creation
detection:
selection_img:
Image|endswith: /osascript
selection_cli_1:
CommandLine|contains|all:
- -e
- display
- dialog
- answer
selection_cli_2:
CommandLine|contains:
- admin
- administrator
- authenticate
- authentication
- credentials
- pass
- password
- unlock
condition: all of selection_*
falsepositives:
- Legitimate administration tools and activities
level: low
license: DRL-1.1
related:
- id: 60f1ce20-484e-41bd-85f4-ac4afec2c541
type: derived