Unusually Large Script Executed by Osascript

[rule]
description = """
Detects when Osascript is executed and an abnormally large script is supplied to be executed. Threat actors have been
increasingly been observed utilizing Osascript to collect sensitive files and stage them for exfiltration using
AppleScript supplied to Osascript via the -e option for execution. These scripts are abnormally large and very uncommon
to see executed in this manner.
"""
id = "40d4b42d-ad3a-478d-88cd-d440fa45cd81"
license = "Elastic License v2"
name = "Unusually Large Script Executed by Osascript"
os_list = ["macos"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "osascript" and 
 process.args == "-e" and 
 (
  process.args_count > 40 or 
  (length(process.command_line) >= 3000 and process.command_line regex """.*\(\{[\s]*\d+[\s]*,[\s]*\d+[\s]*,[\s]*\d+.*""") 
  ) and
 not (process.args : "*checkWWAssetsExistence*" and process.args : "*wwAssetsOpenDocuments*" and process.args : "*isWWAssetsInstalled*")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.11.0"