Elastic Defend high stable eql

In-Memory JXA Execution via ScriptingAdditions

Detects the potential in memory load of a JXA script. JXA allows users to control applications and the operating system using the JavaScript language. Additionally, it can be leveraged in OSAKit from within other macho binaries without spawning the osascript binary. Malicious payloads will use OSAKit to load JXA (.js) scripts into their process memory allowing them to execute post exploitation tasks from memory without being detected. When OSAKit is utilized to load JXA scripts into memory AppleScript, JavaScript and StandardAdditions gets mapped into the process memory.

View Source

Detection Logic

sequence by process.entity_id with maxspan=10s
[library where event.action == "load" and dll.path == "/System/Library/Components/JavaScript.component/Contents/MacOS/JavaScript" and
  not process.executable like "/usr/bin/osascript"]
[library where event.action == "load" and dll.path == "/System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/MacOS/StandardAdditions"]

Field Validations

Loading…

Comments (0)

Loading comments...