Creation of Hidden Login Item via Apple Script

Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence.

Elastic rule (View on GitHub)

  1[metadata]
  2creation_date = "2020/01/05"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2025/01/15"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious
 11program while concealing its presence.
 12"""
 13from = "now-9m"
 14index = ["logs-endpoint.events.*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Creation of Hidden Login Item via Apple Script"
 18risk_score = 47
 19rule_id = "f24bcae1-8980-4b30-b5dd-f851b055c9e7"
 20setup = """## Setup
 21
 22This rule requires data coming in from Elastic Defend.
 23
 24### Elastic Defend Integration Setup
 25Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 26
 27#### Prerequisite Requirements:
 28- Fleet is required for Elastic Defend.
 29- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 30
 31#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
 32- Go to the Kibana home page and click "Add integrations".
 33- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 34- Click "Add Elastic Defend".
 35- Configure the integration name and optionally add a description.
 36- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
 37- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 38- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 39- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 40For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
 41- Click "Save and Continue".
 42- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 43For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 44"""
 45severity = "medium"
 46tags = [
 47    "Domain: Endpoint",
 48    "OS: macOS",
 49    "Use Case: Threat Detection",
 50    "Tactic: Persistence",
 51    "Tactic: Execution",
 52    "Data Source: Elastic Defend",
 53    "Resources: Investigation Guide",
 54]
 55timestamp_override = "event.ingested"
 56type = "eql"
 57
 58query = '''
 59process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "osascript" and
 60 process.command_line : "osascript*login item*hidden:true*"
 61'''
 62note = """## Triage and analysis
 63
 64> **Disclaimer**:
 65> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 66
 67### Investigating Creation of Hidden Login Item via Apple Script
 68
 69AppleScript is a scripting language for automating tasks on macOS, including managing login items. Adversaries exploit this by creating hidden login items to maintain persistence without detection. The detection rule identifies suspicious use of `osascript` to create such items, focusing on command patterns that specify hidden attributes, thus flagging potential stealthy persistence attempts.
 70
 71### Possible investigation steps
 72
 73- Review the process details to confirm the presence of 'osascript' in the command line, specifically looking for patterns like "login item" and "hidden:true" to verify the alert's accuracy.
 74- Investigate the parent process of the 'osascript' execution to determine if it was initiated by a legitimate application or a potentially malicious source.
 75- Check the user account associated with the process to assess whether the activity aligns with typical user behavior or if it suggests unauthorized access.
 76- Examine recent login items and system logs to identify any new or unusual entries that could indicate persistence mechanisms being established.
 77- Correlate the event with other security alerts or logs from the same host to identify any related suspicious activities or patterns.
 78- If possible, retrieve and analyze the AppleScript code executed to understand its purpose and potential impact on the system.
 79
 80### False positive analysis
 81
 82- Legitimate applications or scripts that automate login item management may trigger this rule. Review the process command line details to verify if the application is trusted.
 83- System administrators or IT management tools might use AppleScript for legitimate configuration tasks. Confirm if the activity aligns with scheduled maintenance or deployment activities.
 84- Users with advanced scripting knowledge might create custom scripts for personal use. Check if the script is part of a known user workflow and consider excluding it if verified as non-threatening.
 85- Frequent triggers from the same source could indicate a benign automation process. Implement exceptions for specific scripts or processes after thorough validation to prevent unnecessary alerts.
 86
 87### Response and remediation
 88
 89- Immediately isolate the affected macOS system from the network to prevent potential lateral movement or data exfiltration.
 90- Terminate the suspicious osascript process identified in the alert to halt any ongoing malicious activity.
 91- Remove the hidden login item created by the osascript to eliminate the persistence mechanism. This can be done by accessing the user's login items and deleting any unauthorized entries.
 92- Conduct a thorough scan of the system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or processes.
 93- Review system logs and the user's recent activity to identify any other signs of compromise or related suspicious behavior.
 94- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
 95- Implement enhanced monitoring for osascript usage and login item modifications across the network to detect similar threats in the future."""
 96
 97
 98[[rule.threat]]
 99framework = "MITRE ATT&CK"
100[[rule.threat.technique]]
101id = "T1547"
102name = "Boot or Logon Autostart Execution"
103reference = "https://attack.mitre.org/techniques/T1547/"
104
105
106[rule.threat.tactic]
107id = "TA0003"
108name = "Persistence"
109reference = "https://attack.mitre.org/tactics/TA0003/"
110[[rule.threat]]
111framework = "MITRE ATT&CK"
112[[rule.threat.technique]]
113id = "T1059"
114name = "Command and Scripting Interpreter"
115reference = "https://attack.mitre.org/techniques/T1059/"
116[[rule.threat.technique.subtechnique]]
117id = "T1059.002"
118name = "AppleScript"
119reference = "https://attack.mitre.org/techniques/T1059/002/"
120
121
122
123[rule.threat.tactic]
124id = "TA0002"
125name = "Execution"
126reference = "https://attack.mitre.org/tactics/TA0002/"
127[[rule.threat]]
128framework = "MITRE ATT&CK"
129[[rule.threat.technique]]
130id = "T1647"
131name = "Plist File Modification"
132reference = "https://attack.mitre.org/techniques/T1647/"
133
134
135[rule.threat.tactic]
136id = "TA0005"
137name = "Defense Evasion"
138reference = "https://attack.mitre.org/tactics/TA0005/"

Triage and analysis

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

Investigating Creation of Hidden Login Item via Apple Script

AppleScript is a scripting language for automating tasks on macOS, including managing login items. Adversaries exploit this by creating hidden login items to maintain persistence without detection. The detection rule identifies suspicious use of osascript to create such items, focusing on command patterns that specify hidden attributes, thus flagging potential stealthy persistence attempts.

Possible investigation steps

  • Review the process details to confirm the presence of 'osascript' in the command line, specifically looking for patterns like "login item" and "hidden:true" to verify the alert's accuracy.
  • Investigate the parent process of the 'osascript' execution to determine if it was initiated by a legitimate application or a potentially malicious source.
  • Check the user account associated with the process to assess whether the activity aligns with typical user behavior or if it suggests unauthorized access.
  • Examine recent login items and system logs to identify any new or unusual entries that could indicate persistence mechanisms being established.
  • Correlate the event with other security alerts or logs from the same host to identify any related suspicious activities or patterns.
  • If possible, retrieve and analyze the AppleScript code executed to understand its purpose and potential impact on the system.

False positive analysis

  • Legitimate applications or scripts that automate login item management may trigger this rule. Review the process command line details to verify if the application is trusted.
  • System administrators or IT management tools might use AppleScript for legitimate configuration tasks. Confirm if the activity aligns with scheduled maintenance or deployment activities.
  • Users with advanced scripting knowledge might create custom scripts for personal use. Check if the script is part of a known user workflow and consider excluding it if verified as non-threatening.
  • Frequent triggers from the same source could indicate a benign automation process. Implement exceptions for specific scripts or processes after thorough validation to prevent unnecessary alerts.

Response and remediation

  • Immediately isolate the affected macOS system from the network to prevent potential lateral movement or data exfiltration.
  • Terminate the suspicious osascript process identified in the alert to halt any ongoing malicious activity.
  • Remove the hidden login item created by the osascript to eliminate the persistence mechanism. This can be done by accessing the user's login items and deleting any unauthorized entries.
  • Conduct a thorough scan of the system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or processes.
  • Review system logs and the user's recent activity to identify any other signs of compromise or related suspicious behavior.
  • Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
  • Implement enhanced monitoring for osascript usage and login item modifications across the network to detect similar threats in the future.

Related rules

to-top