326 detection rules reference this catalog entry. View catalog entry.Sigma (71)
- Atomic MacOS Stealer - FileGrabber Activity severity high T1059,T1059.002
- Axios NPM Compromise Indicators - macOS severity high T1059,T1059.002,T1059.004,T1105,T1195,T1195.002
- Binary Padding - MacOS severity high T1027,T1027.001
- Clipboard Access Via OSAScript severity medium T1059,T1059.002,T1115
- Clipboard Data Collection Via Pbpaste severity medium T1115
- Creation Of A Local User Account severity low T1136,T1136.001
- Credentials from Password Stores - Keychain severity medium T1555,T1555.001
- Credentials In Files severity high T1552,T1552.001
- Decode Base64 Encoded Text -MacOs severity low T1027
- Disable Security Tools severity medium T1685
- Disk Image Creation Via Hdiutil - MacOS severity medium
- Disk Image Mounting Via Hdiutil - MacOS severity medium T1560,T1560.001,T1566,T1566.001
- File and Directory Discovery - MacOS severity informational T1083
- File Download Via Nscurl - MacOS severity medium T1105
- File Time Attribute Change severity medium T1070,T1070.006
- Gatekeeper Bypass via Xattr severity low T1553,T1553.001
- Guest Account Enabled Via Sysadminctl severity low T1078,T1078.001
- GUI Input Capture - macOS severity low T1056,T1056.002
- Hidden Flag Set On File/Directory Via Chflags - MacOS severity medium T1105,T1218,T1552,T1552.001,T1564,T1564.004
- Hidden User Creation severity medium T1564,T1564.002
- Indicator Removal on Host - Clear Mac System Logs severity medium T1685,T1685.006
- JAMF MDM Execution severity low
- JAMF MDM Potential Suspicious Child Process severity medium
- JXA In-memory Execution Via OSAScript severity high T1059,T1059.002,T1059.007
- Launch Agent/Daemon Execution Via Launchctl severity medium T1543,T1543.001,T1543.004,T1569,T1569.001
- Local Groups Discovery - MacOs severity informational T1069,T1069.001
- Local System Accounts Discovery - MacOs severity low T1087,T1087.001
- macOS ESF Suspicious Process Execution severity medium
- MacOS Network Service Scanning severity low T1046
- Macos Remote System Discovery severity informational T1018
- MacOS Scripting Interpreter AppleScript severity medium T1059,T1059.002
- Network Sniffing - MacOs severity informational T1040
- New File Exclusion Added To Time Machine Via Tmutil - MacOS severity medium T1490
- Osacompile Execution By Potentially Suspicious Applet/Osascript severity medium T1059,T1059.002
- OSACompile Run-Only Execution severity high T1059,T1059.002
- Payload Decoded and Decrypted via Built-in Utilities severity medium T1059,T1140,T1204
- Potential Base64 Decoded From Images severity high T1140
- Potential Discovery Activity Using Find - MacOS severity medium T1083
- Potential In-Memory Download And Compile Of Payloads severity medium T1059,T1059.007,T1105
- Potential Persistence Via PlistBuddy severity high T1543,T1543.001,T1543.004
- Potential WizardUpdate Malware Infection severity high
- Potential XCSSET Malware Infection severity medium
- Remote Access Tool - Potential MeshAgent Execution - MacOS severity medium T1219,T1219.002
- Remote Access Tool - Renamed MeshAgent Execution - MacOS severity high T1036,T1036.003,T1219,T1219.002
- Remote Access Tool - Team Viewer Session Started On MacOS Host severity low T1133
- Root Account Enable Via Dsenableroot severity medium T1078,T1078.001,T1078.003
- Scheduled Cron Task/Job - MacOs severity medium T1053,T1053.003
- Screen Capture - macOS severity low T1113
- Security Software Discovery - MacOs severity medium T1518,T1518.001
- Space After Filename - macOS severity low T1036,T1036.006
- Split A File Into Pieces severity low T1030
- Suspicious Browser Child Process - MacOS severity medium T1059,T1189,T1203
- Suspicious Execution via macOS Script Editor severity medium T1059,T1059.002,T1204,T1204.001,T1553,T1566
- Suspicious History File Operations severity medium T1552,T1552.003
- Suspicious Installer Package Child Process severity medium T1059,T1059.007,T1071,T1071.001
- Suspicious MacOS Firmware Activity severity medium
- Suspicious Microsoft Office Child Process - MacOS severity high T1059,T1059.002,T1137,T1137.002,T1204,T1204.002
- System Information Discovery Using Ioreg severity medium T1082
- System Information Discovery Using sw_vers severity medium T1082
- System Information Discovery Using System_Profiler severity medium T1082,T1497,T1497.001
- System Information Discovery Via Sysctl - MacOS severity medium T1082,T1497,T1497.001
- System Integrity Protection (SIP) Disabled severity medium T1518,T1518.001
- System Integrity Protection (SIP) Enumeration severity low T1518,T1518.001
- System Network Connections Discovery - MacOs severity informational T1049
- System Network Discovery - macOS severity informational T1016
- System Shutdown/Reboot - MacOs severity informational T1529
- Time Machine Backup Deletion Attempt Via Tmutil - MacOS severity medium T1490
- Time Machine Backup Disabled Via Tmutil - MacOS severity medium T1490
- User Added To Admin Group Via Dscl severity medium T1078,T1078.003
- User Added To Admin Group Via DseditGroup severity medium T1078,T1078.003
- User Added To Admin Group Via Sysadminctl severity medium T1078,T1078.003
Elastic (255)
- Abnormally Large Javascript Evaluation via Nodejs T1059,T1059.007
- Abnormally Large Shell Script Execution via Perl T1059,T1059.004
- Account or Group Discovery via Built-In Tools severity low building block T1069,T1069.001,T1069.002,T1087,T1087.001,T1087.002
- AppleScript Decoded via Base64 T1027,T1059,T1059.002,T1140
- Arbitrary Python Code Execution via Nodejs T1059,T1059.006
- Attempt to establish VScode Remote Tunnel T1059,T1059.001,T1059.003,T1059.004,T1102,T1102.002
- AWS SSM `SendCommand` with Run Shell Command Parameters severity medium T1059,T1059.001,T1059.004,T1651
- AWS SSM Session Manager Child Process Execution severity medium T1059,T1059.001,T1059.004,T1651
- Background Process Execution via Shell T1059,T1059.004
- Base64 Encoded String Execution via Osascript T1027,T1059,T1059.002,T1140
- Bun Script Attempted to Access IMDS Metadata T1552,T1552.005
- Clipboard accessed by Unsigned or Untrusted Binary T1115
- Cocoa Applet Binary Execution T1059,T1059.002
- Code Editor Untrusted or Unsigned Child Process Execution T1059,T1059.004
- Command Execution via Screen Session T1059,T1059.004
- Crypto Wallet File Access via CommandLine T1552,T1552.001
- Curl Download and Execution of JavaScript Payload T1059,T1059.007
- Curl Download and OsaScript Payload Execution via Node T1105
- Curl Execution via Application Shell Script T1105
- Curl Execution via CommandLine Shell Script T1105
- Curl Execution via Shell Profile severity high T1059,T1059.004,T1105,T1546,T1546.004
- Curl Hidden Binary Modification via Osascript T1059,T1059.002,T1105
- Curl Local File Read or Write via Osascript T1105
- Curl or Wget Spawned via Node.js severity medium T1071,T1071.001,T1105
- Curl Output Piped to Osascript T1059,T1059.002,T1105
- Curl to FTP Server via Raw IP T1105
- Curl to Telegram API T1071,T1071.001
- Cursor Arbitrary Code Execution via PHP T1059,T1059.004,T1195,T1195.001
- DARKRADIATION Ransomware Infection T1486
- Data Encrypted and Archived T1027,T1027.013,T1074,T1074.001
- Data Encrypted via OpenSSL Utility severity low T1027,T1027.013,T1074,T1074.001
- Decoded or Decrypted Payload Written to Suspicious Directory T1027,T1059,T1059.004,T1140,T1204,T1204.002
- Decoy Document Creation via Curl T1204,T1204.002
- Decoy file Open via Preview App T1036,T1204,T1204.002
- Default Application Hijacking T1574
- Discovery Command Output Written to Suspicious File severity medium T1016,T1033,T1074,T1074.001,T1082
- Discovery of GitHub Actions Runner Process PID T1057,T1059,T1195,T1195.001
- Disk Image Download and Mount via Hdiutil T1059,T1105,T1204,T1204.002,T1218
- Disown Execution via Shell Command from Volume Mount T1059,T1059.004
- Dscl Execution via Osascript T1033,T1059,T1059.002
- Dylib Injection via Process Environment Variables severity high T1574,T1574.006
- Dylib Loaded by Process in Suspicious Location T1574
- Egress Network Connection from Node.js Descendant T1059,T1059.004,T1071,T1071.001
- Elevated Apple Script Execution via Unsigned Parent T1059,T1548
- Embedded Payload Dropped and Executed T1027,T1027.009
- Empire Stager Execution T1059,T1059.004,T1059.006,T1132,T1132.001
- Environment Variable Secret Collection T1074,T1074.001,T1119
- ExecuteWithPrivileges Prompt via Unsigned or Untrusted Application T1548,T1548.004
- Execution of a File Dropped by OpenSSL T1027,T1140,T1204,T1204.002
- Execution of Javascript Payload via Osascript T1059,T1059.007
- Execution of JavaScript Payload via Python T1059,T1059.007
- Execution of Non-Executable File via Shell T1036,T1059,T1059.004
- Execution of Self-Signed Binary from Volume Mount T1059,T1059.004
- Execution via Electron Child Process Node.js Module T1059,T1059.007,T1548
- Execution via GitHub Actions Runner severity medium T1059,T1059.001,T1059.002,T1059.003,T1059.004,T1059.006
- Exfiltration Data Staging in Temporary Directory via Osascript T1119
- External IP Address Discovery via Curl severity low T1016,T1016.001
- File Download Piped to Script Interpreter T1059
- File hidden via Chflags T1564,T1564.001
- File Hidden via SetFile T1564,T1564.001
- File Made Executable via Package Install Script T1222,T1222.002
- First Time Python Spawned a Shell on Host severity medium T1059,T1059.004,T1059.006
- GitHub Actions Runner with Disabled Telemetry T1059,T1195,T1195.001,T1685
- Hidden AppleScript Download via Curl T1105,T1564,T1564.001
- Information Stealer Collection via Find T1074,T1074.001,T1119
- Initial Access Discovery via Applet Executable T1033,T1059,T1059.004
- Initial Access or Execution via Microsoft Office Application T1027,T1059,T1059.004,T1059.006,T1059.007,T1105
- Initial Access via Audio Unit Plug-in T1059,T1059.004
- Initial Access via macOS Installer Package T1059,T1059.004,T1082,T1105,T1204,T1204.002
- Initial Access via OSA Shell Script Piped to Python Interpreter T1059,T1059.006
- Javascript Reverse Shell via Nodejs T1059,T1059.007,T1195,T1195.001
- Keychain CommandLine Interaction via Unsigned or Untrusted Process severity high T1555,T1555.001
- Keychain Credential Files Collected via Archive Utility T1555,T1555.001
- Keychain Dump via Native Security Tool T1555,T1555.001
- Keychain Password Retrieval via Command Line severity high T1555,T1555.001,T1555.003
- Kill Command Executed from Binary in Unusual Location T1059,T1059.004,T1685
- Killall Execution via Python T1685
- Kubectl Network Configuration Modification severity low T1090,T1572
- Kubectl Permission Discovery severity medium T1069,T1613
- Kubectl Secrets Enumeration Across All Namespaces severity high T1552,T1613
- Kubernetes Direct API Request via Curl or Wget severity medium T1059,T1059.004,T1069,T1552,T1552.007,T1613
- Launchctl Submit Execution of Downloaded File T1569,T1569.001
- Launchpad Hijack T1574
- Lone Binary Execution from Volume Mount T1059,T1059.004
- MacOS Interactive Shell Spawned via Hidden Process T1059,T1059.004
- Malicious Homebrew Initial Access T1105,T1204
- Malicious Ledger Live Execution T1036,T1036.005
- Manual Loading of a Suspicious Chromium Extension severity high T1176,T1176.001,T1185,T1539
- Multi-Layered Deobfuscation via Unusual Parent T1027,T1140
- Network Connection to OAST Domain via Script Interpreter severity high T1059,T1102,T1195,T1195.001,T1567
- Network File Unzipped via Unsigned or Untrusted Binary T1027,T1059,T1059.004,T1140
- New System Kext File and Immediate Load via KextLoad T1059,T1059.004,T1547,T1547.006
- Node Script Execution and Immediate Deletion T1070,T1070.004
- Node.js Pre or Post-Install Script Execution severity medium T1059,T1059.004,T1059.007,T1195,T1195.001,T1204
- Nodejs Initial Access via VSCode Auto-run Task T1059,T1059.007,T1195,T1195.001
- Nodejs Javascript Execution via Osascript T1059,T1059.007
- NotificationCenter Silenced via Killall Binary T1685
- OSA Script Execution via Unsigned or Untrusted Parent T1059,T1059.002
- OsaScript Download Cradle Spawned T1008
- Osascript Execution via Piped AppleScript T1059,T1059.002
- Osascript Payload Drop and Execute T1105
- Payload Decoded and Decrypted via Built-In Utilities T1027,T1059,T1059.004,T1140,T1204,T1204.002
- Payload Delivery via Curl and Immediate Execution T1059,T1059.004,T1105
- Payload Piped to Script Interpreter T1059,T1059.006
- Pbpaste Execution via Unusual Parent Process severity high T1115
- Perl Outbound Network Connection severity medium T1059,T1059.006,T1071,T1071.001
- Persistence via GenAI Tool T1037,T1037.004,T1543,T1543.001,T1543.004,T1547
- Potential Access to Kerberos Cached Credentials T1558,T1558.005
- Potential Binary Masquerading via Invalid Code Signature T1036,T1036.001
- Potential ClickFix Attack via Base64 Decoded Payload T1204,T1204.001,T1566,T1566.002
- Potential Cloud Credential Harvesting via Bun T1195,T1195.001,T1528,T1552,T1552.001
- Potential Credential Harvesting via Python T1059,T1059.006,T1555
- Potential Credential Validation via Sudo from Unusual Parent T1056,T1056.002
- Potential Credentials Phishing via Osascript T1056,T1056.002
- Potential Data Exfiltration Through Curl severity medium T1048,T1048.001,T1048.003
- Potential Data Exfiltration via Curl T1048
- Potential Decoy Document via Open T1204,T1204.002
- Potential EtherHiding C2 via Curl JSON-RPC Request severity high T1059,T1059.002,T1059.004,T1102,T1102.001,T1102.002
- Potential Execution via VS Code Tasks T1195,T1195.001,T1566,T1566.002
- Potential Git CVE-2025-48384 Exploitation severity high T1059,T1059.004,T1105,T1203
- Potential Git CVE-2025-48384 Exploitation T1203
- Potential Impersonation Attempt via Kubectl severity medium T1078,T1528,T1550,T1550.001,T1552
- Potential Kubectl Masquerading via Unexpected Process severity medium T1036,T1036.003,T1564,T1564.001,T1609,T1610
- Potential Masquerading as System Binary T1036,T1036.004,T1059,T1059.004
- Potential Persistence via Direct Crontab Modification T1053,T1053.003
- Potential Python Reverse Shell T1059,T1071
- Potential Python Stealer T1059,T1059.006,T1552,T1552.001
- Potential Reverse Shell Activity via Terminal T1059,T1071
- Potential SIP Bypass via the ShoveService T1068
- Potential TCC Bypass via Electron Web Inspector API T1218
- Potential WizardUpdate Malware Infection
- Potential XCSSET Malware Infection
- Powershell Outbound Network Connection T1059,T1059.001
- Privilege Escalation Enumeration via LinPEAS T1059,T1059.004
- Privileged Container Creation with Host Directory Mount severity high T1059,T1059.004,T1609,T1610,T1611
- Process Discovery via Built-In Applications severity low building block T1057,T1518,T1518.001
- Processes with Trailing Spaces severity low T1036,T1036.006
- Prompt for Credentials with Osascript severity high T1056,T1056.002,T1059,T1059.002
- Python Initial Access via Google Drive T1059,T1059.006,T1059.007,T1105
- Python Outbound Network Connection over FTP T1105
- Python Script Execution via Shell and Remote Network Connection T1059,T1059.006,T1105
- Quarantine Attribute Deleted via Untrusted Binary T1553,T1553.001
- Quarantine Cleared via Xattr Followed by Ad-hoc Codesign T1553,T1553.001
- Reading or Modifying Downloaded Files Database via SQLite Utility
- Remote GitHub Actions Runner Registration severity medium T1059,T1195,T1195.002,T1219
- ROT encoded Python Script Execution T1027,T1027.013,T1140
- Screensaver Plist File Modified by Unexpected Process T1546
- Script Interpreter Connection to Non-Standard Port severity medium T1059,T1059.005,T1059.006,T1059.007,T1571
- Self-Deleted Python Script Outbound Network Connection T1059,T1059.006,T1070,T1070.004,T1105
- Self-Deleting Python Script T1059,T1059.006,T1070,T1070.004
- Sensitive File Access via Rsync T1005,T1048
- Sensitive File Copy via Ditto T1005
- Shell Command Curl Execution via Osascript T1059,T1059.002,T1105
- Shell Command Discovery Execution via Untrusted Binary T1059,T1059.004
- Shell Command Piped to Osascript via Shell Script T1059,T1059.002,T1059.004
- Shell Execution via Apple Scripting severity medium T1059,T1059.002,T1059.004
- Shell Script Execution from abnormal Volume Mount Path T1059,T1059.004
- Shlayer Malware Infection T1105
- Sudo Heap-Based Buffer Overflow Attempt T1059,T1059.004,T1068
- SUID/SGID Bit Set severity low T1548,T1548.001
- Suspicious Apple Script Execution T1059,T1105
- Suspicious Archive Creation via Ditto T1074,T1074.001
- Suspicious Automator Application Execution T1059,T1059.002
- Suspicious Automator Workflows Execution T1059,T1059.007
- Suspicious Binary Execution via SSH T1059,T1059.004
- Suspicious Child Process Execution via Interactive Shell T1059,T1059.004
- Suspicious Child Process of Expect T1059,T1059.004
- Suspicious Codesign Execution via Osacompile T1059,T1059.004
- Suspicious Crypto Wallet Process Termination T1685
- Suspicious Curl Execution via Automator Workflow T1059,T1059.004,T1105
- Suspicious Curl Execution via NodeJS T1059,T1059.007,T1105
- Suspicious Curl File Download and Execution T1105
- Suspicious Curl from macOS Application severity high T1071,T1071.001,T1105,T1553,T1553.001
- Suspicious Curl to Jamf Endpoint severity high T1059,T1059.002,T1059.006,T1059.007,T1072
- Suspicious Curl to OAST Domain T1105
- Suspicious Curl to Raw IP via Perl T1105
- Suspicious Curl User Agent T1105
- Suspicious DD Execution T1027,T1059,T1059.004,T1140
- Suspicious Deobfuscation via Shell Script T1027,T1140
- Suspicious Dscl Auth Validation T1033,T1059,T1059.004
- Suspicious Electron Command Execution T1059,T1059.004
- Suspicious Elevated Command Execution T1059,T1059.004
- Suspicious Executable Copied from Volume Mount T1036,T1036.005
- Suspicious Executable Download via Curl T1059,T1059.002,T1105
- Suspicious Executable File Creation via Python T1059,T1059.006,T1105
- Suspicious Execution of Unsigned or Untrusted Process via Sudo T1059,T1059.004
- Suspicious Execution via Script Editor T1059,T1059.002,T1204,T1204.001,T1553,T1566
- Suspicious File Downloaded from Google Drive severity medium T1102,T1102.003,T1105
- Suspicious File Overwrite and Modification via Echo T1027,T1059,T1059.004
- Suspicious File Quarantine Removal via Find T1553,T1553.001
- Suspicious Hidden Executable and Immediate Network Connection T1071,T1071.001,T1105
- Suspicious Image Creation via ScreenCapture T1059,T1059.004,T1113
- Suspicious Installer Package Spawns Network Event severity medium T1059,T1059.002,T1059.004,T1059.006,T1059.007,T1071
- Suspicious Installer Remote Plugin Service Child Process T1559,T1559.003
- Suspicious Interactive Shell Execution T1059,T1059.004
- Suspicious Interpreter Execution from Stdin T1027,T1059,T1059.006
- Suspicious Large Script Execution via Shell Command T1059,T1059.002,T1059.004
- Suspicious macOS MS Office Child Process severity medium T1059,T1059.002,T1059.004,T1059.006,T1203,T1204
- Suspicious Network Connection to Gmail via Nodejs T1059,T1059.007,T1071,T1071.003
- Suspicious Network Connection via Installer Package T1059,T1059.007,T1071,T1071.001
- Suspicious Outbound Network Connection via Unsigned Binary severity high T1553,T1553.001,T1571
- Suspicious pbpaste High Volume Activity severity medium T1056,T1115
- Suspicious Perl Child Process Execution T1059,T1059.004
- Suspicious Privileged Docker Execution T1068,T1611
- Suspicious PrivilegedHelperTool Activity T1068
- Suspicious Process Execution by Zoom severity high T1059,T1059.002,T1059.004,T1059.006,T1203
- Suspicious Python One-Liner with Encoded Payload Execution T1027,T1059,T1059.006
- Suspicious Python Package Child Process Execution T1059,T1059.004,T1059.006
- Suspicious Python Script Execution and Network Connection T1059,T1059.006
- Suspicious Python Shell Command Execution severity medium T1059,T1059.006
- Suspicious React Server Child Process severity high T1033,T1059,T1059.001,T1059.003,T1059.004,T1059.006
- Suspicious Recursive File Deletion via Built-In Utilities T1485,T1565
- Suspicious Remote Javascript Evaluation via Nodejs T1059,T1059.007
- Suspicious Script Compilation via Osacompile T1059,T1059.004
- Suspicious Script or Process Execution from Mounted Device T1204,T1204.002
- Suspicious SIP Check by macOS Application severity medium T1082,T1497,T1497.001
- Suspicious Terminal Child Process Execution T1059,T1059.004
- Suspicious Terraform Provider Execution and Network Connection T1071,T1071.001,T1195,T1195.002
- Suspicious TruffleHog Execution via NodeJS T1059,T1059.007,T1195,T1195.001,T1555
- Suspicious Unsigned Application Execution via Shell T1059,T1059.004
- Suspicious VSCode Extension Child Process T1105
- System Hosts File Access severity low building block T1016,T1018
- System Network Connections Discovery severity low building block T1016,T1049
- System Reconnaissance from Unsigned Parent Followed by Network Connection T1071,T1071.001,T1082
- SystemKey Access via Command Line T1555,T1555.001
- Tampering of Bash Command-Line History T1070,T1070.003
- Tampering of Shell Command-Line History severity medium T1070,T1070.003
- Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners severity medium T1036,T1036.009,T1059,T1195,T1195.001,T1685
- Tccutil Reset via Suspicious Binary T1548,T1548.006
- Tclsh Execution followed by immediate Network Connection T1059
- Temporary Binary Execution via Osascript T1059,T1059.002
- Terminal closed with Pkill or Killall T1564,T1564.003
- Terminal Window Hidden or Closed via Osascript T1564,T1564.003
- Timestomping using Touch Command severity medium T1070,T1070.006
- Trap Signals Execution severity low T1546,T1546.005
- Unexpected Child Process of macOS Screensaver Engine T1546,T1546.002
- Unsigned or Untrusted binary Execution via Cron T1053,T1053.003
- Unsigned or Untrusted Binary Execution via XPC call T1059,T1059.004,T1559,T1559.003
- Unsigned or Untrusted Binary Execution via Zshrc T1546,T1546.004
- Unsigned or Untrusted Process Execution and Immediate Self-Deletion T1070,T1070.004
- Untrusted or Unsigned Binary Executed via Launch Service T1546,T1546.016
- Untrusted or Unsigned binary Execution via Osascript T1059,T1059.002
- Unusual Bundle Execution via Shell T1059,T1059.004
- Unusually large OSA script execution via Shell Command T1059,T1059.002
- Unusually Large Script Executed by Osascript T1059,T1059.002
- URL as argument to Python Script and Immediate Network Connection T1071,T1071.001,T1105
- User Discovery Command Execution from Volume Mount T1033,T1059,T1059.004
- User Keychain copied via Script Interpreter T1555,T1555.001
- User Keychain copied via Shell interpreter T1555,T1555.001
- User Keychain Copied via Suspicious Parent T1555,T1555.001
- User Keychain Exfiltration via Curl T1048,T1555,T1555.001
- Velociraptor Suspicious Shell Execution T1059,T1059.004,T1218,T1219
- Volume Muted via Osascript T1059,T1059.002
- Web Browsers Password Access via Command Line T1555,T1555.003
- WebProxy Settings Modification severity medium T1539,T1557