Execution of Javascript Payload via Osascript

[rule]
description = """
Identifies when the native Osascript binary spawns itself to execute a Javascript payload. An adversary may use this
technique to execute their malicious payload and obtain initial access to an endpoint.
"""
id = "207f36d5-1aa0-4827-9055-bec5747de03b"
license = "Elastic License v2"
name = "Execution of Javascript Payload via Osascript"
os_list = ["macos"]
reference = ["https://github.com/MythicAgents/apfell"]
version = "1.0.9"

query = '''
process where event.action == "exec" and process.name == "osascript" and
 process.parent.name == "osascript" and
 process.args == "-l" and process.args : "JavaScript*" and
 not process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService")
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.5.0"