attack.t1059.002 | Detection.FYI

Clipboard Data Collection Via OSAScript

Aug 12, 2024 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·
Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

Read More
JXA In-memory Execution Via OSAScript

Aug 12, 2024 · attack.t1059.002 attack.t1059.007 attack.execution ·
Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

Read More
MacOS Scripting Interpreter AppleScript

Aug 12, 2024 · attack.execution attack.t1059.002 ·
Share on:

Detects execution of AppleScript of the macOS scripting language AppleScript.

Read More
Osacompile Execution By Potentially Suspicious Applet/Osascript

Aug 12, 2024 · attack.execution attack.t1059.002 ·
Share on:

Detects potential suspicious applet or osascript executing "osacompile".

Read More
OSACompile Run-Only Execution

Aug 12, 2024 · attack.t1059.002 attack.execution ·
Share on:

Detects potential suspicious run-only executions compiled using OSACompile

Read More
Suspicious Execution via macOS Script Editor

Aug 12, 2024 · attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense-evasion ·
Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Read More
Suspicious Microsoft Office Child Process - MacOS

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·
Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Read More
In-memory Downloading and Compiling of Applets as Payloads

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.002 ·
Share on:

This analytic uses a single ES_EVENT_TYPE_NOTIFY_EXEC event and looks for the the execution of curl, |, or osacompile commands. Part of the RedCanary 2024 Threat Detection Report.

Read More
Mac AppleScript Input Prompt

Mar 26, 2024 · attack.execution attack.t1059 attack.t1059.002 ·
Share on:

Adversaries leverage AppleScript to try to steal the user’s login password. This analytic attempts to detect that activity via the first variation. Part of the RedCanary 2024 Threat Detection Report.

Read More