huntrule

macOS Script Editor Spawning Unusual Processes (curl, shells, scripting runtimes)

Alerts when Script Editor launches command-line tools or interpreters like curl, shell binaries, python, or perl.

FreeUnreviewedSigmamediumv1
title: macOS Script Editor Spawning Unusual Processes (curl, shells, scripting runtimes)
id: 4f59ff31-f290-4620-b004-71b1250df591
status: test
description: This rule flags process creation events where the parent process is the macOS Script Editor and the child process matches a set of suspicious utilities or interpreters. Attackers can leverage Script Editor to run external commands for execution, initial access, or persistence using common command-line tools and scripting runtimes. The detection relies on macOS process creation telemetry containing parent and child image paths.
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685
  - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml
date: 2022-10-21
modified: 2022-12-28
logsource:
  category: process_creation
  product: macos
tags:
  - attack.defense-impairment
  - attack.t1566
  - attack.t1566.002
  - attack.initial-access
  - attack.t1059
  - attack.t1059.002
  - attack.t1204
  - attack.t1204.001
  - attack.execution
  - attack.persistence
  - attack.t1553
detection:
  selection_parent:
    ParentImage|endswith: /Script Editor
  selection_img:
    - Image|endswith:
        - /curl
        - /bash
        - /sh
        - /zsh
        - /dash
        - /fish
        - /osascript
        - /mktemp
        - /chmod
        - /php
        - /nohup
        - /openssl
        - /plutil
        - /PlistBuddy
        - /xattr
        - /sqlite
        - /funzip
        - /popen
    - Image|contains:
        - python
        - perl
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
    type: derived

What it detects

This rule flags process creation events where the parent process is the macOS Script Editor and the child process matches a set of suspicious utilities or interpreters. Attackers can leverage Script Editor to run external commands for execution, initial access, or persistence using common command-line tools and scripting runtimes. The detection relies on macOS process creation telemetry containing parent and child image paths.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.