huntrule

macOS GUI Credential Prompt Capture via osascript

Flags osascript command lines that script system dialogs referencing authentication and password-related terms.

FreeReviewedSigma · Low · v2
Product
macos
Category
process_creation
Author
remotephone, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-13
Updated
2026-07-31
AnalysisDetection
title: macOS GUI Credential Prompt Capture via osascript
id: 1fd0ebd8-4b25-45ba-8d22-b613538a2d6d
status: test
description: This rule flags process executions of osascript that use AppleScript dialog prompts (display dialog) and include keywords related to authentication and credentials. Attackers may use system dialogs to solicit or capture sensitive information from users. It relies on macOS process creation telemetry, specifically the executed image path ending with /osascript and the command-line arguments used.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md
  - https://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2025-12-05
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.002
logsource:
  product: macos
  category: process_creation
detection:
  selection_img:
    Image|endswith: /osascript
  selection_cli_1:
    CommandLine|contains|all:
      - -e
      - display
      - dialog
      - answer
  selection_cli_2:
    CommandLine|contains:
      - admin
      - administrator
      - authenticate
      - authentication
      - credentials
      - pass
      - password
      - unlock
  condition: all of selection_*
falsepositives:
  - Legitimate administration tools and activities
level: low
license: DRL-1.1
related:
  - id: 60f1ce20-484e-41bd-85f4-ac4afec2c541
    type: derived