Elastic Defend high stable eql

Suspicious Execution via Script Editor

Identifies when the macOS Script Editor utility spawns an unusual child process, this may indicate an attempt to execute a malicious Apple Script via a malicious applescript URL handler.

View Source

Detection Logic

process where event.action == "exec" and

 (process.parent.executable == "/System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor" or process.Ext.effective_parent.executable == "/System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor") and

 // Suspicious processes spawned by the Script Editor
 (process.name like~ ("curl", "nscurl", "osascript", "python*", "perl*", "mktemp", "chmod", "php", "nohup", "openssl", "plutil", "PlistBuddy", "xattr", "mktemp", "sqlite3", "funzip", "open") or

  // Process masquerading as Apple but has an invalid signature
  (process.name like~ "com.apple.*" and not process.code_signature.signing_id like~ "com.apple.*")
 )

Field Validations

Loading…

Comments (0)

Loading comments...