JXA In-memory Execution Via OSAScript

Status: test
Severity: high
Log source: category process_creation, product macos
Author: Sohan G (D4rkCiph3r)
Source: github.com/SigmaHQ/sigma

Detects possible malicious execution of JXA in-memory via OSAScript

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.002` Command and Scripting Interpreter: AppleScript `T1059.007` Command and Scripting Interpreter: JavaScript

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: JXA In-memory Execution Via OSAScript
id: f1408a58-0e94-4165-b80a-da9f96cf6fc3
related:
    - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55
      type: derived
status: test
description: Detects possible malicious execution of JXA in-memory via OSAScript
references:
    - https://redcanary.com/blog/applescript/
author: Sohan G (D4rkCiph3r)
date: 2023-01-31
tags:
    - attack.t1059.002
    - attack.t1059.007
    - attack.execution
logsource:
    product: macos
    category: process_creation
detection:
    selection_main:
        CommandLine|contains|all:
            - 'osascript'
            - ' -e '
            - 'eval'
            - 'NSData.dataWithContentsOfURL'
    selection_js:
        - CommandLine|contains|all:
              - ' -l '
              - 'JavaScript'
        - CommandLine|contains: '.js'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_main`

selection_main:
    CommandLine|contains|all:
        - 'osascript'
        - ' -e '
        - 'eval'
        - 'NSData.dataWithContentsOfURL'

Stage 2: `selection_js`

selection_js:
    - CommandLine|contains|all:
          - ' -l '
          - 'JavaScript'
    - CommandLine|contains: '.js'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-e` `-l` `.js` `JavaScript` `NSData.dataWithContentsOfURL` `eval` `osascript`	`field:"CommandLine" kind:match`

JXA In-memory Execution Via OSAScript

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_main

Stage 2: selection_js

Indicators

Stage 0: `condition`

Stage 1: `selection_main`

Stage 2: `selection_js`