macOS Process Creation: OSACompile Run-Only Execution via Inline -e Script

title: "macOS Process Creation: OSACompile Run-Only Execution via Inline -e Script"
id: 1c8c6087-726e-427f-b073-c6045857059f
status: test
description: This rule identifies macOS process creation events where the command line contains osacompile with both the run-only flag (-x) and an inline script argument (-e). Attackers can use osacompile to execute AppleScript from the command line, enabling rapid one-off execution without creating persistent script files. Detection relies on process start telemetry with a command line field that includes the expected osacompile arguments.
references:
  - https://redcanary.com/blog/applescript/
  - https://ss64.com/osx/osacompile.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_osacompile_runonly_execution.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-01-31
tags:
  - attack.t1059.002
  - attack.execution
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - osacompile
      - " -x "
      - " -e "
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b9d9b652-d8ed-4697-89a2-a1186ee680ac
    type: derived