Command and Scripting Interpreter: AppleScript T1059.002

Tactic: Execution

Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents. These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 27 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (25 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
process_name16eq 8, wildcard 6, in 5, starts_with 3bash, osascript, curl, node, base64
event.type14eq 8, in 6start, process_started
host.os.type14eq 14
CommandLine13contains 10, wildcard 3, is_not_null 1 -e , .js, curl, osacompile, -l
parent_process_name8eq 4, in 2, wildcard 2, starts_with 1bash, node, Google Chrome, Google Chrome Helper*, Microsoft Edge
EventType7eq 6, in 1exec, ProcessRollup2, exec_event, modification
Image5ends_with 4, contains 1, starts_with 1/bash, /curl, /osascript, /chmod, /dash
ParentImage5ends_with 4, contains 1opencode, /applet, /osascript, /script editor, microsoft excel
DestinationHostname3wildcard 2, ends_with 1, is_null 1, starts_with 1*.s3*.amazonaws.com, .cloudfront.net, calendar.app.google, eth-mainnet*, eth.*.com
process.args3eq 3-c, -e
ParentCommandLine2contains 1, wildcard 1*runner*entrypoint.sh, clawdbot, moltbot, openclaw
process.parent.code_signature.exists2eq 2false
process.parent.code_signature.trusted2eq 2false
Esql.connection_count1ge 120
columns.cmdline1contains 1, in 1 -e , *QEMU*, *VMware*

Top indicator values (287 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
8606
event.typein
process_started
640
event.typein
start
642
process_nameeq
osascript
610
process_namewildcard
curl
616
process_namewildcard
osascript
613
process_namewildcard
python*
624
process_namewildcard
bash
414
process_namewildcard
perl*
411
process_namewildcard
sh
414
process_namewildcard
base64
34
process_namewildcard
chmod
34
process_namewildcard
php*
316
process_namewildcard
pwsh
33
process_namewildcard
wget
311
process_namewildcard
zsh
313
EventTypeeq
exec
5171
CommandLinecontains
-e
414
CommandLinecontains
curl
317
CommandLinecontains
osascript
3
CommandLinecontains
.js
29
CommandLinecontains
nscurl
22
CommandLinecontains
osacompile
23
CommandLinecontains
set fileref
2
CommandLinecontains
set imagedata to the clipboard
2
Imageends_with
/osascript
47
process_namein
bash
388
process_namein
sh
383
process_namein
zsh
382
process_namestarts_with
python
331

Exclusions (79 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
CommandLinecontains
-e
2
CommandLinecontains
osascript
2
CommandLinecontains
set fileref
2
CommandLinecontains
set imagedata to the clipboard
2
CommandLinecontains
$cffixed_user_home/.zoterointegrationpipe
1
CommandLinecontains
-e with timeout of 3600 seconds
1
CommandLinecontains
encryption key escrow
1
ParentImageends_with
opencode
2
CommandLinewildcard
*com.microsoft.Outlook/Data/tmp/Outlook*Temp*
1
ParentCommandLinestarts_with
sudo
1
ParentImageeq
/bin/bash
1
ParentImageeq
/usr/bin/sudo
1
ParentImagein
/applications/microsoft outlook 2.app/contents/macos/microsoft outlook
1
ParentImagein
/applications/microsoft outlook.app/contents/macos/microsoft outlook
1
ParentImagein
/applications/microsoft/microsoft outlook.app/contents/macos/microsoft outlook
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 9 rules

Elastic 16 rules

Splunk 1 rule

Panther 1 rule