Clipboard Access Via OSAScript

Status: test
Severity: medium
Log source: category process_creation, product macos
Author: Sohan G (D4rkCiph3r)
Source: github.com/SigmaHQ/sigma

Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts

Known false positives

Legitimate clipboard utilities and automation scripts that read or write clipboard content
Developer tools and IDEs that use osascript for clipboard integration

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.002` Command and Scripting Interpreter: AppleScript
Collection	`T1115` Clipboard Data

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Clipboard Access Via OSAScript
id: 7794fa3c-edea-4cff-bec7-267dd4770fd7
related:
    - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55
      type: derived
status: test
description: Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts
references:
    - https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/
author: Sohan G (D4rkCiph3r)
date: 2023-01-31
modified: 2026-05-22
tags:
    - attack.collection
    - attack.execution
    - attack.t1115
    - attack.t1059.002
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/osascript'
        CommandLine|contains|all:
            - ' -e '
            - 'clipboard'
    filter_optional_opencode:
        # OpenCode uses osascript to handle copying text from the TUI on MacOS devices. See https://github.com/anomalyco/opencode/blob/ca723f1cbc6fc4244ae57e61e9de8c4e37380ed4/packages/opencode/src/cli/cmd/tui/util/clipboard.ts#L65 for reference.
        ParentImage|endswith: 'opencode'
        CommandLine|contains|all:
            - 'osascript'
            - ' -e '
            - 'set imageData to the clipboard'
            - 'set fileRef'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Legitimate clipboard utilities and automation scripts that read or write clipboard content
    - Developer tools and IDEs that use osascript for clipboard integration
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    Image|endswith: '/osascript'
    CommandLine|contains|all:
        - ' -e '
        - 'clipboard'

Stage 2: `not filter_optional_opencode`

filter_optional_opencode:
    ParentImage|endswith: 'opencode'
    CommandLine|contains|all:
        - 'osascript'
        - ' -e '
        - 'set imageData to the clipboard'
        - 'set fileRef'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`-e`	`excludes:CommandLine` `field:"CommandLine" value:" -e "`
`CommandLine`	match	`osascript`	`excludes:CommandLine` `field:"CommandLine" value:"osascript"`
`CommandLine`	match	`set fileRef`	`excludes:CommandLine` `field:"CommandLine" value:"set fileRef"`
`CommandLine`	match	`set imageData to the clipboard`	`excludes:CommandLine` `field:"CommandLine" value:"set imageData to the clipboard"`
`ParentImage`	ends_with	`opencode`	`excludes:ParentImage` `field:"ParentImage" value:"opencode"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-e` `clipboard`	`field:"CommandLine" kind:match`
`Image`	ends_with	`/osascript`	`field:"Image" kind:ends_with value:"/osascript"`