Uncommon AppleScript containing a potential obfuscation technique was executed

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	AppleScript Analytics, Evasion Analytics
ATT&CK Tactic	Execution (TA0002), Defense Evasion (TA0005)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Obfuscated Files or Information: Command Obfuscation (T1027.010)
Severity	Low

Description

The AppleScript interpreter process was executed with an obfuscation technique in the command line.

Attacker's Goals

Evade defenses and impede forensics by encrypting, encoding, or obfuscating payloads at rest or in transit.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Verify the legitimacy of the persistence mechanism being created or modified.

Variations

Uncommon AppleScript containing a potential obfuscation technique was executed subsequently running a shell command

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Defense Evasion (TA0005)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Obfuscated Files or Information: Command Obfuscation (T1027.010)
Severity	Medium

Description

The AppleScript interpreter process was executed with an obfuscation technique in the command line.

Attacker's Goals

Evade defenses and impede forensics by encrypting, encoding, or obfuscating payloads at rest or in transit.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Verify the legitimacy of the persistence mechanism being created or modified.

Uncommon AppleScript containing a potential obfuscation technique was executed by an uncommon parent process

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Defense Evasion (TA0005)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Obfuscated Files or Information: Command Obfuscation (T1027.010)
Severity	High

Description

The AppleScript interpreter process was executed with an obfuscation technique in the command line.

Attacker's Goals

Evade defenses and impede forensics by encrypting, encoding, or obfuscating payloads at rest or in transit.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Verify the legitimacy of the persistence mechanism being created or modified.