Suspicious Execution via macOS Script Editor

{
  "selection_parent": {
    "ParentImage
| endswith": "/Script Editor"
  },
  "selection_img": [
    {
      "Image
| endswith": [
        "/curl",
        "/bash",
        "/sh",
        "/zsh",
        "/dash",
        "/fish",
        "/osascript",
        "/mktemp",
        "/chmod",
        "/php",
        "/nohup",
        "/openssl",
        "/plutil",
        "/PlistBuddy",
        "/xattr",
        "/sqlite",
        "/funzip",
        "/popen"
      ]
    },
    {
      "Image
| contains": [
        "python",
        "perl"
      ]
    }
  ],
  "condition": "all of selection_*"
}

False Positives

• ⚠ Unknown