Elastic Defend high stable eql

Suspicious Apple Script Execution

Identifies the execution of the Apple script interpreter (osascript) process with suspicious command line arguments. This behavior is consistent with an attacker executing malicious scripts for execution or command and control.

View Source

Detection Logic

process where event.action == "exec" and
 process.name == "osascript" and
 process.args like~ "JavaScript" and
 process.command_line like~ "*eval(*" and
 process.command_line like~ ("*initWithDataEncoding*", "*dataWithContentsOfURL*", "*URLWithString*", "*http*")

Field Validations

Loading…

Comments (0)

Loading comments...