macOS Process Execution of osascript Running AppleScript Scripts

Flags osascript usage on macOS with -e and script indicators consistent with executing AppleScript.

FreeUnreviewedSigmamediumv1

macos-process-execution-of-osascript-running-applescript-scripts-1bc2e6c5

title: macOS Process Execution of osascript Running AppleScript Scripts
id: 90b48d2b-9283-42cb-88bd-9e5824673bf3
status: test
description: This rule identifies macOS process executions where the interpreter binary osascript is used with command-line arguments consistent with running AppleScript code and related script files. Attackers can leverage AppleScript to automate user actions, execute logic locally, and potentially launch other actions under the context of the process that invoked osascript. It relies on process creation telemetry, specifically the Image path and command-line arguments such as the -e option and script file indicators (.scpt, .js), while excluding a known opencode-related pattern.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md
  - https://redcanary.com/blog/applescript/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_applescript.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-21
modified: 2026-05-21
tags:
  - attack.execution
  - attack.t1059.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /osascript
    CommandLine|contains:
      - " -e "
      - .scpt
      - .js
  filter_optional_opencode:
    ParentImage|endswith: opencode
    CommandLine|contains|all:
      - osascript
      - " -e "
      - set imageData to the clipboard
      - set fileRef
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Application installers might contain scripts as part of the installation process.
level: medium
license: DRL-1.1
related:
  - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55
    type: derived

What it detects

This rule identifies macOS process executions where the interpreter binary osascript is used with command-line arguments consistent with running AppleScript code and related script files. Attackers can leverage AppleScript to automate user actions, execute logic locally, and potentially launch other actions under the context of the process that invoked osascript. It relies on process creation telemetry, specifically the Image path and command-line arguments such as the -e option and script file indicators (.scpt, .js), while excluding a known opencode-related pattern.

Known false positives

Application installers might contain scripts as part of the installation process.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.