Suspicious Execution through macOS Script Editor (via process_creation)

title: Suspicious Execution through macOS Script Editor (via process_creation)
id: e25203d9-93b4-5952-9074-92f15f299d0c
status: stable
description: This rule detects when the macOS Script Editor utility spawns an unusual child process.
author: Huntrule Team
references:
    - https://attack.mitre.org/techniques/T1553/
    - https://attack.mitre.org/techniques/T1204/001/
    - https://attack.mitre.org/techniques/T1204/
    - https://attack.mitre.org/techniques/T1059/002/
    - https://attack.mitre.org/techniques/T1059/
    - https://attack.mitre.org/techniques/T1566/002/
    - https://attack.mitre.org/techniques/T1566/
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685
    - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/
date: 2026-07-02
logsource:
    category: process_creation
    product: macos
tags:
    - attack.defense-impairment
    - attack.t1566
    - attack.t1566.002
    - attack.initial-access
    - attack.t1059
    - attack.t1059.002
    - attack.t1204
    - attack.t1204.001
    - attack.execution
    - attack.persistence
    - attack.t1553
detection:
    selection_parent:
        ParentImage|endswith: '/Script Editor'
    selection_img:
        - Image|endswith:
              - '/curl'
              - '/bash'
              - '/sh'
              - '/zsh'
              - '/dash'
              - '/fish'
              - '/osascript'
              - '/mktemp'
              - '/chmod'
              - '/php'
              - '/nohup'
              - '/openssl'
              - '/plutil'
              - '/PlistBuddy'
              - '/xattr'
              - '/sqlite'
              - '/funzip'
              - '/popen'
        - Image|contains:
              - 'python'
              - 'perl'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium