Detection: MacOS AppleScript Shell Execution and Compilation

Description

The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic. The analytic identifies osascript invocations using AppleScript's do shell script command, which executes shell commands on the host. It also identifies osacompile invocations referencing do shell script. osacompile compiles AppleScript into a compiled script but does not execute it directly. Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving osacompile should be interpreted as script compilation or staging rather than confirmed shell-command execution.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5FROM datamodel=Endpoint.Processes WHERE
 6
 7Processes.process_name IN ("osascript", "osacompile")
 8Processes.process="*do *"
 9Processes.process="* shell *"
10Processes.process="* script*"
11
12BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec
13   Processes.parent_process_guid Processes.parent_process_id
14   Processes.parent_process_name Processes.parent_process_path
15   Processes.process Processes.process_exec Processes.process_guid
16   Processes.process_hash Processes.process_id Processes.process_integrity_level
17   Processes.process_name Processes.process_path Processes.user
18   Processes.user_id Processes.vendor_product
19
20
21| `drop_dm_object_name(Processes)`
22
23
24| eval activity_type=case(
25        process_name="osascript", "AppleScript Shell Command Execution",
26        process_name="osacompile", "AppleScript Compilation or Staging"
27    )
28
29
30| `security_content_ctime(firstTime)`
31
32| `security_content_ctime(lastTime)`
33
34
35| table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product
36
37
38| `macos_applescript_shell_execution_and_compilation_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models.

Known False Positives

Legitimate administrative scripts or automation tools using Applescript.

Associated Analytic Story

• MacOS Post-Exploitation

Intermediate Findings

Threat Objects

References

• https://attack.mitre.org/techniques/T1059/002/

• https://www.loobins.io/binaries/osascript/

• https://attack.mitre.org/tactics/TA0002/

• https://redcanary.com/threat-detection-report/techniques/applescript/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1