Elastic medium stable eql
Creation of Hidden Login Item via Apple Script
Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence.
Detection Logic
process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "osascript" and
process.command_line : "osascript*login item*hidden:true*"Field Validations
Loading…
Comments (0)
Loading comments...