CmdID

CmdID / Techniques / T1059

T1059.002 Command and Scripting Interpreter: AppleScript

Adversaries may abuse AppleScript for execution. MITRE ATT&CK

9 Sigma rules T1059.002 on attack.mitre.org

Part of

MITRE ATT&CK
T1059Command and Scripting Interpreter

Sigma rules tagged with it

process creation, the highest levels first
highAtomic MacOS Stealer - FileGrabber ActivityJason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) · macOS
highAxios NPM Compromise Indicators - macOSSwachchhanda Shrawan Poudel (Nextron Systems) · macOS
highJXA In-memory Execution Via OSAScriptSohan G (D4rkCiph3r) · macOS
highOSACompile Run-Only ExecutionSohan G (D4rkCiph3r) · macOS
highSuspicious Microsoft Office Child Process - MacOSSohan G (D4rkCiph3r) · macOS
mediumClipboard Access Via OSAScriptSohan G (D4rkCiph3r) · macOS
mediumMacOS Scripting Interpreter AppleScriptAlejandro Ortuno, oscd.community · macOS
mediumOsacompile Execution By Potentially Suspicious Applet/OsascriptSohan G (D4rkCiph3r), Red Canary (Idea) · macOS
mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea) · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Run an AppleScript command on the page for osascript

osascript -e 'say "Hello world"'Identify

Run multiple AppleScript commands on the page for osascript

osascript -e 'say "Hello"' -e 'say "world"'Identify

Run a compiled (*.scpt), bundled (*.scptd), or plaintext (*.applescript) AppleScript file on the page for osascript

osascript path/to/apple.scptIdentify

Get the bundle identifier of an application (useful for open -b) on the page for osascript

osascript -e 'id of app "Application"'Identify

Run a JavaScript command on the page for osascript

osascript -l JavaScript -e "console.log('Hello world');"Identify

Run a JavaScript file on the page for osascript

osascript -l JavaScript path/to/script.jsIdentify

An example is here when CmdID’s reading of it names T1059.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.