Uncommon AppleScript containing a potential persistence command was executed via the command line

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	AppleScript Analytics, Generic Persistence Analytics
ATT&CK Tactic	Execution (TA0002), Persistence (TA0003)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Boot or Logon Autostart Execution (T1547)
Severity	Low

Description

The AppleScript interpreter executed an uncommon command potentially used for persistence to maintain system access.

Attacker's Goals

Establish persistence on the system through various mechanisms to maintain access.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Verify the legitimacy of the persistence mechanism being created or modified.

Variations

Uncommon AppleScript containing a potential persistence command was executed via the command line targeting a .plist file for modification

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Persistence (TA0003)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Create or Modify System Process: Launch Agent (T1543.001), Create or Modify System Process: Launch Daemon (T1543.004)
Severity	High

Description

The AppleScript interpreter executed an uncommon command potentially used for persistence to maintain system access.

Attacker's Goals

Establish persistence on the system through various mechanisms to maintain access.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Verify the legitimacy of the persistence mechanism being created or modified.

Uncommon AppleScript containing a potential persistence command was executed via the command line targeting launchctl load command execution

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Persistence (TA0003)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Create or Modify System Process: Launch Agent (T1543.001), Create or Modify System Process: Launch Daemon (T1543.004)
Severity	Low

Description

The AppleScript interpreter executed an uncommon command potentially used for persistence to maintain system access.

Attacker's Goals

Establish persistence on the system through various mechanisms to maintain access.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Verify the legitimacy of the persistence mechanism being created or modified.