CmdID

CmdID / Commands

osascript

Run AppleScript or JavaScript for Automation (JXA). tldr-pages

On macOS 7 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Run an AppleScript command

osascript -e 'say "Hello world"'Identify

Trips 1 Sigma rule: mediumMacOS Scripting Interpreter AppleScript by Alejandro Ortuno, oscd.community

Run multiple AppleScript commands

osascript -e 'say "Hello"' -e 'say "world"'Identify

Trips 1 Sigma rule: mediumMacOS Scripting Interpreter AppleScript by Alejandro Ortuno, oscd.community

Run a compiled (*.scpt), bundled (*.scptd), or plaintext (*.applescript) AppleScript file

osascript path/to/apple.scptIdentify

Trips 1 Sigma rule: mediumMacOS Scripting Interpreter AppleScript by Alejandro Ortuno, oscd.community

Get the bundle identifier of an application (useful for open -b)

osascript -e 'id of app "Application"'Identify

Trips 1 Sigma rule: mediumMacOS Scripting Interpreter AppleScript by Alejandro Ortuno, oscd.community

Run a JavaScript command

osascript -l JavaScript -e "console.log('Hello world');"Identify

Trips 1 Sigma rule: mediumMacOS Scripting Interpreter AppleScript by Alejandro Ortuno, oscd.community

Run a JavaScript file

osascript -l JavaScript path/to/script.jsIdentify

Trips 1 Sigma rule: mediumMacOS Scripting Interpreter AppleScript by Alejandro Ortuno, oscd.community

What detects it

Sigma process creation rules that name osascript
highSuspicious Microsoft Office Child Process - MacOSSohan G (D4rkCiph3r)
mediumClipboard Access Via OSAScriptSohan G (D4rkCiph3r)
mediumMacOS Scripting Interpreter AppleScriptAlejandro Ortuno, oscd.community
mediumSuspicious Browser Child Process - MacOSSohan G (D4rkCiph3r)
mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea)
mediumSuspicious Installer Package Child ProcessSohan G (D4rkCiph3r)
lowGUI Input Capture - macOSremotephone, oscd.community