Osascript Execution via Piped AppleScript

[rule]
description = """
Detects when AppleScript is directly piped to the Osascript binary for execution. Threat actors utilize this method in
order to avoid traditional Osascript detections and perform various tasks on the system.
"""
id = "e955b5d2-2396-4af2-9540-680aa390c547"
license = "Elastic License v2"
name = "Osascript Execution via Piped AppleScript"
os_list = ["macos"]
reference = ["https://blog.kandji.io/malware-cuckoo-infostealer-spyware"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and (process.name in ("sh", "bash", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
 process.args == "-c" and process.command_line like~ "*osascript*<<EOD*"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.2"