AppleScript process executed with a rare command line

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	AppleScript Analytics
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002)
Severity	Informational

Description

The AppleScript interpreter process was executed with an uncommon command line.

Attacker's Goals

Perform various actions via AppleScript code, such as establishing persistence, evading detection, executing secondary payloads or injecting remote processes.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.

Variations

AppleScript process executed with a rare command line containing uncommon arguments

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002)
Severity	High

Description

The AppleScript interpreter process was executed with an uncommon command line.

Attacker's Goals

Perform various actions via AppleScript code, such as establishing persistence, evading detection, executing secondary payloads or injecting remote processes.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.

AppleScript process executed with a rare command line possibly using Finder to perform operations

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002)
Severity	High

Description

The AppleScript interpreter process was executed with an uncommon command line.

Attacker's Goals

Perform various actions via AppleScript code, such as establishing persistence, evading detection, executing secondary payloads or injecting remote processes.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.

AppleScript process executed with a rare command line with an unusual password prompt

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002)
Severity	Low

Description

The AppleScript interpreter process was executed with an uncommon command line.

Attacker's Goals

Perform various actions via AppleScript code, such as establishing persistence, evading detection, executing secondary payloads or injecting remote processes.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.

AppleScript process executed with a rare command line that possibly injects JavaScript into a browser

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002)
Severity	Low

Description

The AppleScript interpreter process was executed with an uncommon command line.

Attacker's Goals

Perform various actions via AppleScript code, such as establishing persistence, evading detection, executing secondary payloads or injecting remote processes.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.

AppleScript process executed with a rare command line performing clipboard access

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002)
Severity	Low

Description

The AppleScript interpreter process was executed with an uncommon command line.

Attacker's Goals

Perform various actions via AppleScript code, such as establishing persistence, evading detection, executing secondary payloads or injecting remote processes.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.

AppleScript process executed with a rare command line that muted the audio output

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002)
Severity	Low

Description

The AppleScript interpreter process was executed with an uncommon command line.

Attacker's Goals

Perform various actions via AppleScript code, such as establishing persistence, evading detection, executing secondary payloads or injecting remote processes.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.