Detects potential suspicious applet or osascript executing "osacompile".
Detects possible collection of data from the clipboard via execution of the osascript binary
Detects possible malicious execution of JXA in-memory via OSAScript
Detects potential suspicious run-only executions compiled using OSACompile
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
Detects when the macOS Script Editor utility spawns an unusual child process.
Detects execution of AppleScript of the macOS scripting language AppleScript.