Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	AppleScript Analytics, Credentials Grabbing Analytics
ATT&CK Tactic	Execution (TA0002), Credential Access (TA0006)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Credentials from Password Stores (T1555)
Severity	Low

Description

The AppleScript interpreter potentially utilizes credential-grabbing techniques to steal user passwords.

Attacker's Goals

Harvest user credentials and passwords from sensitive locations such as the macOS Keychain or directory services to enable unauthorized access, lateral movement, or privilege escalation.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.

Variations

Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords leveraging the 'dscl -authonly' command to covertly verify the captured password

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Privilege Escalation (TA0004)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Valid Accounts (T1078)
Severity	High

Description

The AppleScript interpreter potentially utilizes credential-grabbing techniques to steal user passwords.

Attacker's Goals

Harvest user credentials and passwords from sensitive locations such as the macOS Keychain or directory services to enable unauthorized access, lateral movement, or privilege escalation.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.
• Check the events generated by the process or its children for potential malicious behavior.
• Check whether the process was executed in an unusual way.