{"id":"6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4","title":"Suspicious Execution via macOS Script Editor","description":"Detects when the macOS Script Editor utility spawns an unusual child process.","author":"Tim Rauch (rule), Elastic (idea)","status":"test","level":"medium","date":"2022-10-21","modified":"2022-12-28","tags":["attack.defense-impairment","attack.t1566","attack.t1566.002","attack.initial-access","attack.t1059","attack.t1059.002","attack.t1204","attack.t1204.001","attack.execution","attack.persistence","attack.t1553"],"technique_ids":["T1059","T1059.002","T1204","T1204.001","T1553","T1566","T1566.002"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Unknown"],"references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685","https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/"],"source_path":"rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml","source_sha256":"0cf77b055a8a63cda09f474f01515ff8c1803e00f2b4eadeeb53988144be3402","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Execution via macOS Script Editor\nid: 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4\nstatus: test\ndescription: Detects when the macOS Script Editor utility spawns an unusual child process.\nauthor: Tim Rauch (rule), Elastic (idea)\nreferences:\n    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685\n    - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/\ndate: 2022-10-21\nmodified: 2022-12-28\nlogsource:\n    category: process_creation\n    product: macos\ntags:\n    - attack.defense-impairment\n    - attack.t1566\n    - attack.t1566.002\n    - attack.initial-access\n    - attack.t1059\n    - attack.t1059.002\n    - attack.t1204\n    - attack.t1204.001\n    - attack.execution\n    - attack.persistence\n    - attack.t1553\ndetection:\n    selection_parent:\n        ParentImage|endswith: '/Script Editor'\n    selection_img:\n        - Image|endswith:\n              - '/curl'\n              - '/bash'\n              - '/sh'\n              - '/zsh'\n              - '/dash'\n              - '/fish'\n              - '/osascript'\n              - '/mktemp'\n              - '/chmod'\n              - '/php'\n              - '/nohup'\n              - '/openssl'\n              - '/plutil'\n              - '/PlistBuddy'\n              - '/xattr'\n              - '/sqlite'\n              - '/funzip'\n              - '/popen'\n        - Image|contains:\n              - 'python'\n              - 'perl'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1059.002","id":"T1059.002","name":"AppleScript","page":"techniques/enterprise/T1059.002/"},{"key":"enterprise/T1204","id":"T1204","name":"User Execution","page":"techniques/enterprise/T1204/"},{"key":"enterprise/T1204.001","id":"T1204.001","name":"Malicious Link","page":"techniques/enterprise/T1204.001/"},{"key":"enterprise/T1553","id":"T1553","name":"Subvert Trust Controls","page":"techniques/enterprise/T1553/"},{"key":"enterprise/T1566","id":"T1566","name":"Phishing","page":"techniques/enterprise/T1566/"},{"key":"enterprise/T1566.002","id":"T1566.002","name":"Spearphishing Link","page":"techniques/enterprise/T1566.002/"}],"data_path":"data/detection-rules/6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4.json","kind":"sigma"}