detection.wiki

Detection rules › Sigma

Osacompile Execution By Potentially Suspicious Applet/Osascript

Status
test
Severity
medium
Log source
category process_creation, product macos
Author
Sohan G (D4rkCiph3r), Red Canary (Idea)
Source
github.com/SigmaHQ/sigma

Detects potential suspicious applet or osascript executing "osacompile".

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

PlatformRecord / event type
macOSESF event exec (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Osacompile Execution By Potentially Suspicious Applet/Osascript
id: a753a6af-3126-426d-8bd0-26ebbcb92254
status: test
description: Detects potential suspicious applet or osascript executing "osacompile".
references:
    - https://redcanary.com/blog/mac-application-bundles/
author: Sohan G (D4rkCiph3r), Red Canary (Idea)
date: 2023-04-03
tags:
    - attack.execution
    - attack.t1059.002
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        ParentImage|endswith:
            - '/applet'
            - '/osascript'
        CommandLine|contains: 'osacompile'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    ParentImage|endswith:
        - '/applet'
        - '/osascript'
    CommandLine|contains: 'osacompile'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • osacompile
field:"CommandLine" kind:match value:"osacompile"
ParentImageends_with
  • /applet
  • /osascript
field:"ParentImage" kind:ends_with