huntrule

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Alerts when Script Editor launches command-line tools or interpreters like curl, shell binaries, python, or perl.

FreeReviewedSigma · Medium · v2
Product
macos
Category
process_creation
Author
Tim Rauch (rule), Elastic (idea) (SigmaHQ), DRL 1.1
Published
2022-10-21
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where the parent process is the macOS Script Editor (path ending with /Script Editor) and the spawned child image matches a set of unusual tooling such as curl, common shell interpreters, osascript, and file/permission/plist utilities. Attackers may leverage Script Editor to run AppleScript or scripting workflows that pivot into external commands for execution and initial access. The detection relies on macOS process creation telemetry that includes parent and child process image paths.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange
Suspicious Masqueraded Windows Update Python Script Execution
Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution
AWS CloudTrail SSM SendCommand Successful Execution for Instance
macOS: Built-in openssl used to base64-decode and decrypt payload from mounted DMG volume
Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)
Suspicious Cloudflare Workers Brand-Impersonation Phishing Domains via Proxy
Suspicious NFe-Themed Brazilian Lure Executable Execution
Suspicious Python Execution via Renamed Synaptics Binary
Suspicious Osascript Requesting Administrator Privileges (via process_creation)
macOS Script Editor Spawns Suspicious Command-Line Interpreters
Pivot detection · T1059 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.