From b90428210e4344bd189054c77926c78bac3b07cb Mon Sep 17 00:00:00 2001 From: Radka Date: Thu, 3 Sep 2026 18:00:01 +0200 Subject: [PATCH 1/5] initial commit --- ...ty_osascript_do_shell_script_execution.yml | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml diff --git a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml b/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml new file mode 100644 index 0000000000..cea0c93199 --- /dev/null +++ b/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml @@ -0,0 +1,62 @@ +name: MacOS Utility Osascript Do Shell Script Execution +id: ceee1f2b-4b40-4721-b91e-40d1134e9dc4 +version: 1 +creation_date: '2026-09-01' +modification_date: '2026-09-03' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: Utility osascript or osacompile was used with the "do shell script" method on a macOS device. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_path="*/osascript" OR Processes.process_path="*/osacompile") Processes.process="*do shell script*" by Processes.dest Processes.user Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_utility_osascript_do_shell_script_execution_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative scripts or automation tools using Applescript. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://www.loobins.io/binaries/osascript/ + - https://redcanary.com/threat-detection-report/techniques/applescript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 30 + message: Suspicious osascript binary inline command execution via $process$ detected on $dest$ +threat_objects: + - field: process_path + type: process +analytic_story: + - MacOS Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/97298afb925f826d8bc9c10918b1f102771e6ea7/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log + source: osquery + sourcetype: osquery:results + test_type: unit From 908e71f013cec964d8f198024bb448bc911280fc Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:07:37 +0200 Subject: [PATCH 2/5] Update macos_utility_osascript_do_shell_script_execution.yml --- ...ty_osascript_do_shell_script_execution.yml | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml b/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml index cea0c93199..fae20578e0 100644 --- a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml +++ b/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml @@ -6,11 +6,23 @@ modification_date: '2026-09-03' author: Radka Viskova, Splunk status: production type: Anomaly -description: Utility osascript or osacompile was used with the "do shell script" method on a macOS device. +description: |- + OSA Framework binary was used to execute shell commands on a MacOS host. OSA allows + interaction with MaccOS terminal through `do shell script` command of the AppleScript. data_source: - Osquery Results search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_path="*/osascript" OR Processes.process_path="*/osacompile") Processes.process="*do shell script*" by Processes.dest Processes.user Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + FROM datamodel=Endpoint.Processes + WHERE (Processes.process_name="osascript" + OR Processes.process_name="osacompile") + Processes.process="*do shell script*" + BY Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_utility_osascript_do_shell_script_execution_filter` @@ -38,12 +50,12 @@ intermediate_findings: - field: dest type: system score: 30 - message: Suspicious osascript binary inline command execution via $process$ detected on $dest$ + message: Osascript inline command execution via $process$ detected on $dest$ threat_objects: - - field: process_path + - field: process type: process analytic_story: - - MacOS Privilege Escalation + - MacOS Post-Exploitation asset_type: Endpoint mitre_attack_id: - T1059.002 @@ -56,7 +68,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/97298afb925f826d8bc9c10918b1f102771e6ea7/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log source: osquery sourcetype: osquery:results test_type: unit From f24ac43817f5c85ae3b7b32cd3b77c23d5b20d2d Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:11:50 +0200 Subject: [PATCH 3/5] Update macos_utility_osascript_do_shell_script_execution.yml --- .../macos_utility_osascript_do_shell_script_execution.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml b/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml index fae20578e0..8849d28a2f 100644 --- a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml +++ b/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml @@ -23,6 +23,7 @@ search: |- Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_utility_osascript_do_shell_script_execution_filter` From 42c9925fa6a5473dc83d1727006df8b9ffa404bb Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Fri, 4 Sep 2026 20:46:54 +0200 Subject: [PATCH 4/5] Update macos_utility_osascript_do_shell_script_execution.yml --- ...ty_osascript_do_shell_script_execution.yml | 42 ++++++++++++------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml b/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml index 8849d28a2f..4ad3003da8 100644 --- a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml +++ b/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml @@ -1,35 +1,43 @@ name: MacOS Utility Osascript Do Shell Script Execution id: ceee1f2b-4b40-4721-b91e-40d1134e9dc4 version: 1 -creation_date: '2026-09-01' +creation_date: '2026-09-03' modification_date: '2026-09-03' author: Radka Viskova, Splunk status: production type: Anomaly description: |- - OSA Framework binary was used to execute shell commands on a MacOS host. OSA allows - interaction with MaccOS terminal through `do shell script` command of the AppleScript. + The following analytic detects the use of the OSA Framework binary to execute shell commands on a MacOS host. + OSA allows interaction with MacOS terminal through `do shell script` command of the AppleScript. + Adversaries may use this to execute shell commands on a MacOS host, potentially for persistence or privilege escalation. data_source: - Osquery Results search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Processes - WHERE (Processes.process_name="osascript" - OR Processes.process_name="osacompile") - Processes.process="*do shell script*" - BY Processes.dest Processes.original_file_name Processes.parent_process_id + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ("osascript", "osacompile") + Processes.process="*do *" + Processes.process="* shell *" + Processes.process="* script*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id - Processes.process_current_directory Processes.process_name - Processes.process_path Processes.user + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_utility_osascript_do_shell_script_execution_filter` how_to_implement: |- This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. - Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. + Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models. known_false_positives: |- Legitimate administrative scripts or automation tools using Applescript. references: @@ -50,9 +58,11 @@ intermediate_findings: entities: - field: dest type: system - score: 30 - message: Osascript inline command execution via $process$ detected on $dest$ + score: 20 + message: Osascript inline command execution via [$process$] was observed on [$dest$] threat_objects: + - field: parent_process + type: process - field: process type: process analytic_story: @@ -69,7 +79,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log source: osquery sourcetype: osquery:results test_type: unit From 9f22420a362998f2aecb63ad3b9c8cb9894cccc9 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Fri, 4 Sep 2026 23:48:58 +0200 Subject: [PATCH 5/5] small metadata update --- ...cript_shell_execution_and_compilation.yml} | 30 ++++++++++++------- 1 file changed, 19 insertions(+), 11 deletions(-) rename detections/endpoint/{macos_utility_osascript_do_shell_script_execution.yml => macos_applescript_shell_execution_and_compilation.yml} (65%) diff --git a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml similarity index 65% rename from detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml rename to detections/endpoint/macos_applescript_shell_execution_and_compilation.yml index 4ad3003da8..be5632f118 100644 --- a/detections/endpoint/macos_utility_osascript_do_shell_script_execution.yml +++ b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml @@ -1,4 +1,4 @@ -name: MacOS Utility Osascript Do Shell Script Execution +name: MacOS AppleScript Shell Execution and Compilation id: ceee1f2b-4b40-4721-b91e-40d1134e9dc4 version: 1 creation_date: '2026-09-03' @@ -7,9 +7,10 @@ author: Radka Viskova, Splunk status: production type: Anomaly description: |- - The following analytic detects the use of the OSA Framework binary to execute shell commands on a MacOS host. - OSA allows interaction with MacOS terminal through `do shell script` command of the AppleScript. - Adversaries may use this to execute shell commands on a MacOS host, potentially for persistence or privilege escalation. + The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic. + The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host. + It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly. + Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution. data_source: - Osquery Results search: |- @@ -23,18 +24,27 @@ search: |- Processes.process="* shell *" Processes.process="* script*" - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + + | eval activity_type=case( + process_name="osascript", "AppleScript Shell Command Execution", + process_name="osacompile", "AppleScript Compilation or Staging" + ) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `macos_utility_osascript_do_shell_script_execution_filter` + + | table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product + + | `macos_applescript_shell_execution_and_compilation_filter` how_to_implement: |- This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models. @@ -59,10 +69,8 @@ intermediate_findings: - field: dest type: system score: 20 - message: Osascript inline command execution via [$process$] was observed on [$dest$] + message: AppleScript shell execution or compilation via [$process_name$] with commandline [$process$] was observed on [$dest$]. threat_objects: - - field: parent_process - type: process - field: process type: process analytic_story: