Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Clipboard Data Collection Via OSAScript

Detects possible collection of data from the clipboard via execution of the osascript binary

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Sohan G (D4rkCiph3r)Created Tue Jan 317794fa3c-edea-4cff-bec7-267dd4770fd7macos
Log Source
macOSProcess Creation
ProductmacOS← raw: macos
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains|all:
            - 'osascript'
            - ' -e '
            - 'clipboard'
    condition: selection
False Positives
Unlikely

False positives are unlikely for most environments. High confidence detection.

References
1
Resolving title…
sentinelone.com
MITRE ATT&CK
Related Rules
DerivedDetectionmedium

MacOS Scripting Interpreter AppleScript

Detects execution of AppleScript of the macOS scripting language AppleScript.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
7794fa3c-edea-4cff-bec7-267dd4770fd7
Status
test
Level
high
Type
Detection
Created
Tue Jan 31
Author
Sohan G (D4rkCiph3r)
Path
rules/macos/process_creation/proc_creation_macos_clipboard_data_via_osascript.yml
Raw Tags
attack.collectionattack.executionattack.t1115attack.t1059.002
View on GitHub