Detectionmediumtest

Suspicious Execution via macOS Script Editor

Detects when the macOS Script Editor utility spawns an unusual child process.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Tim Rauch, Elastic SecurityCreated Fri Oct 21Updated Wed Dec 286e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4macos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_parent:
        ParentImage|endswith: '/Script Editor'
    selection_img:
        - Image|endswith:
              - '/curl'
              - '/bash'
              - '/sh'
              - '/zsh'
              - '/dash'
              - '/fish'
              - '/osascript'
              - '/mktemp'
              - '/chmod'
              - '/php'
              - '/nohup'
              - '/openssl'
              - '/plutil'
              - '/PlistBuddy'
              - '/xattr'
              - '/sqlite'
              - '/funzip'
              - '/popen'
        - Image|contains:
              - 'python'
              - 'perl'
    condition: all of selection_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0001 · Initial Access TA0002 · Execution TA0003 · Persistence TA0005 · Defense Evasion

Techniques

T1566 · Phishing T1059 · Command and Scripting Interpreter T1204 · User Execution T1553 · Subvert Trust Controls

Sub-techniques

T1566.002 · Spearphishing Link T1059.002 · AppleScript T1204.001 · Malicious Link

Rule Metadata

Rule ID

6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Status

test

Level

medium

Type

Detection

Created

Fri Oct 21

Modified

Wed Dec 28

Author

Tim Rauch, Elastic Security

Path

rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml

Raw Tags

attack.t1566attack.t1566.002attack.initial-accessattack.t1059attack.t1059.002attack.t1204attack.t1204.001attack.executionattack.persistenceattack.t1553attack.defense-evasion

View on GitHub