Sigma medium test sigma

MacOS Scripting Interpreter AppleScript

Detects execution of AppleScript of the macOS scripting language AppleScript.

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "/osascript",
    "CommandLine
| contains": [
      " -e ",
      ".scpt",
      ".js"
    ]
  },
  "filter_optional_opencode": {
    "ParentImage
| endswith": "opencode",
    "CommandLine
| contains
| all": [
      "osascript",
      " -e ",
      "set imageData to the clipboard",
      "set fileRef"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

False Positives

  • ⚠ Application installers might contain scripts as part of the installation process.

Field Validations

Loading…

Comments (0)

Loading comments...