Elastic Defend high stable eql

Execution of Javascript Payload via Osascript

Identifies when the native Osascript binary spawns itself to execute a Javascript payload. An adversary may use this technique to execute their malicious payload and obtain initial access to an endpoint.

View Source

Detection Logic

process where event.action == "exec" and process.name == "osascript" and
 process.parent.name == "osascript" and
 process.args == "-l" and process.args : "JavaScript*" and
 not process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService")

Field Validations

Loading…

Comments (0)

Loading comments...