{"id":"b9d9b652-d8ed-4697-89a2-a1186ee680ac","title":"OSACompile Run-Only Execution","description":"Detects potential suspicious run-only executions compiled using OSACompile","author":"Sohan G (D4rkCiph3r)","status":"test","level":"high","date":"2023-01-31","modified":"","tags":["attack.t1059.002","attack.execution"],"technique_ids":["T1059.002"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://redcanary.com/blog/applescript/","https://ss64.com/osx/osacompile.html"],"source_path":"rules/macos/process_creation/proc_creation_macos_osacompile_runonly_execution.yml","source_sha256":"3e26c1f8c5fad9273cd2ef8acac48272e3629af7278d86e5b3f6038fe3755d1e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_osacompile_runonly_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: OSACompile Run-Only Execution\nid: b9d9b652-d8ed-4697-89a2-a1186ee680ac\nstatus: test\ndescription: Detects potential suspicious run-only executions compiled using OSACompile\nreferences:\n    - https://redcanary.com/blog/applescript/\n    - https://ss64.com/osx/osacompile.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-01-31\ntags:\n    - attack.t1059.002\n    - attack.execution\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'osacompile'\n            - ' -x '\n            - ' -e '\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.002","id":"T1059.002","name":"AppleScript","page":"techniques/enterprise/T1059.002/"}],"data_path":"data/detection-rules/b9d9b652-d8ed-4697-89a2-a1186ee680ac.json","kind":"sigma"}