macOS Script Editor Spawns Suspicious Command-Line Interpreters

Alerts when Script Editor launches command-line tools or interpreters like curl, shell binaries, python, or perl.

FreeReviewedSigma · Medium · v2

Product: macos
Category: process_creation
Author: Tim Rauch (rule), Elastic (idea) (SigmaHQ), DRL 1.1
Published: 2022-10-21
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1566Phishing
- T1566.002Spearphishing Link
Execution
Persistence
Priv Esc
Defense Evasion
- T1553Subvert Trust Controls
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the parent process is the macOS Script Editor (path ending with /Script Editor) and the spawned child image matches a set of unusual tooling such as curl, common shell interpreters, osascript, and file/permission/plist utilities. Attackers may leverage Script Editor to run AppleScript or scripting workflows that pivot into external commands for execution and initial access. The detection relies on macOS process creation telemetry that includes parent and child process image paths.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Suspicious Masqueraded Windows Update Python Script Execution

Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

AWS CloudTrail SSM SendCommand Successful Execution for Instance

macOS: Built-in openssl used to base64-decode and decrypt payload from mounted DMG volume

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Suspicious Cloudflare Workers Brand-Impersonation Phishing Domains via Proxy

Suspicious NFe-Themed Brazilian Lure Executable Execution

Suspicious Python Execution via Renamed Synaptics Binary

Suspicious Osascript Requesting Administrator Privileges (via process_creation)

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Pivot detection · T1059 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-script-editor-spawning-unusual-processes-curl-shells-scripting-runtimes-6e4dcdd1

title: macOS Script Editor Spawns Suspicious Command-Line Interpreters
id: 4f59ff31-f290-4620-b004-71b1250df591
status: test
description: This rule flags process creation events where the parent process is the macOS Script Editor (path ending with /Script Editor) and the spawned child image matches a set of unusual tooling such as curl, common shell interpreters, osascript, and file/permission/plist utilities. Attackers may leverage Script Editor to run AppleScript or scripting workflows that pivot into external commands for execution and initial access. The detection relies on macOS process creation telemetry that includes parent and child process image paths.
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685
  - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml
date: 2022-10-21
modified: 2022-12-28
logsource:
  category: process_creation
  product: macos
tags:
  - attack.defense-impairment
  - attack.t1566
  - attack.t1566.002
  - attack.initial-access
  - attack.t1059
  - attack.t1059.002
  - attack.t1204
  - attack.t1204.001
  - attack.execution
  - attack.persistence
  - attack.t1553
detection:
  selection_parent:
    ParentImage|endswith: /Script Editor
  selection_img:
    - Image|endswith:
        - /curl
        - /bash
        - /sh
        - /zsh
        - /dash
        - /fish
        - /osascript
        - /mktemp
        - /chmod
        - /php
        - /nohup
        - /openssl
        - /plutil
        - /PlistBuddy
        - /xattr
        - /sqlite
        - /funzip
        - /popen
    - Image|contains:
        - python
        - perl
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL