Osacompile Execution By Potentially Suspicious Applet/Osascript

testmedium
Log-Quelle: macos · process_creationAutor Sohan G (D4rkCiph3r), Red Canary (Idea)Datum 2023-04-03
01

Beschreibung

Was dies ist, in Kürze.

Detects potential suspicious applet or osascript executing "osacompile".

02

Tags

attack.executionattack.t1059.002
03

Regelquelle (YAML)

title: Osacompile Execution By Potentially Suspicious Applet/Osascript
id: a753a6af-3126-426d-8bd0-26ebbcb92254
status: test
description: Detects potential suspicious applet or osascript executing "osacompile".
references:
    - https://redcanary.com/blog/mac-application-bundles/
author: Sohan G (D4rkCiph3r), Red Canary (Idea)
date: 2023-04-03
tags:
    - attack.execution
    - attack.t1059.002
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        ParentImage|endswith:
            - '/applet'
            - '/osascript'
        CommandLine|contains: 'osacompile'
    condition: selection
falsepositives:
    - Unknown
level: medium
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.