Uncommon AppleScript with a potential defense-evasion command was executed via the command line

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	AppleScript Analytics, Evasion Analytics
ATT&CK Tactic	Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Disable or Modify Tools (T1685), Subvert Trust Controls (T1553)
Severity	Low

Description

The AppleScript interpreter executed a command to modify system configuration, bypass security controls, or evade detection.

Attacker's Goals

Employ defense evasion techniques by modifying system configurations and disabling or bypassing security tools.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.

• Check the events generated by the process or its children for potential malicious behavior.

• Verify the legitimacy of the defense evasion technique being employed.

Variations

Uncommon AppleScript with a potential defense-evasion command was executed via the command line disabling the Gatekeeper security feature

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Disable or Modify Tools (T1685), Subvert Trust Controls (T1553), Subvert Trust Controls: Gatekeeper Bypass (T1553.001)
Severity	High

Description

The AppleScript interpreter executed a command to modify system configuration, bypass security controls, or evade detection.

Attacker's Goals

Employ defense evasion techniques by modifying system configurations and disabling or bypassing security tools.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.

• Check the events generated by the process or its children for potential malicious behavior.

• Verify the legitimacy of the defense evasion technique being employed.

Uncommon AppleScript with a potential defense-evasion command was executed via the command line manipulating the 'hosts' file

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Disable or Modify Tools (T1685), Subvert Trust Controls (T1553)
Severity	Medium

Description

The AppleScript interpreter executed a command to modify system configuration, bypass security controls, or evade detection.

Attacker's Goals

Employ defense evasion techniques by modifying system configurations and disabling or bypassing security tools.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.

• Check the events generated by the process or its children for potential malicious behavior.

• Verify the legitimacy of the defense evasion technique being employed.

Uncommon AppleScript with a potential defense-evasion command was executed via the command line deleting attributes from a file

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Disable or Modify Tools (T1685), Subvert Trust Controls (T1553), Subvert Trust Controls: Gatekeeper Bypass (T1553.001)
Severity	Low

Description

The AppleScript interpreter executed a command to modify system configuration, bypass security controls, or evade detection.

Attacker's Goals

Employ defense evasion techniques by modifying system configurations and disabling or bypassing security tools.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.

• Check the events generated by the process or its children for potential malicious behavior.

• Verify the legitimacy of the defense evasion technique being employed.

Uncommon AppleScript with a potential defense-evasion command was executed via the command line setting a network proxy

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Defense Impairment (TA0112)
ATT&CK Technique	Command and Scripting Interpreter: AppleScript (T1059.002), Disable or Modify Tools (T1685), Subvert Trust Controls (T1553)
Severity	Low

Description

The AppleScript interpreter executed a command to modify system configuration, bypass security controls, or evade detection.

Attacker's Goals

Employ defense evasion techniques by modifying system configurations and disabling or bypassing security tools.

Investigative actions

• Analyze the command line and determine whether it performs any malicious or suspicious actions.

• Check the events generated by the process or its children for potential malicious behavior.

• Verify the legitimacy of the defense evasion technique being employed.