{"id":"f1408a58-0e94-4165-b80a-da9f96cf6fc3","title":"JXA In-memory Execution Via OSAScript","description":"Detects possible malicious execution of JXA in-memory via OSAScript","author":"Sohan G (D4rkCiph3r)","status":"test","level":"high","date":"2023-01-31","modified":"","tags":["attack.t1059.002","attack.t1059.007","attack.execution"],"technique_ids":["T1059.002","T1059.007"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://redcanary.com/blog/applescript/"],"source_path":"rules/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml","source_sha256":"0a44f3d2462e699865a0653d862d2ffd5c014654a2c10e5851c7fe35a647088f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: JXA In-memory Execution Via OSAScript\nid: f1408a58-0e94-4165-b80a-da9f96cf6fc3\nrelated:\n    - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55\n      type: derived\nstatus: test\ndescription: Detects possible malicious execution of JXA in-memory via OSAScript\nreferences:\n    - https://redcanary.com/blog/applescript/\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-01-31\ntags:\n    - attack.t1059.002\n    - attack.t1059.007\n    - attack.execution\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection_main:\n        CommandLine|contains|all:\n            - 'osascript'\n            - ' -e '\n            - 'eval'\n            - 'NSData.dataWithContentsOfURL'\n    selection_js:\n        - CommandLine|contains|all:\n              - ' -l '\n              - 'JavaScript'\n        - CommandLine|contains: '.js'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.002","id":"T1059.002","name":"AppleScript","page":"techniques/enterprise/T1059.002/"},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"}],"data_path":"data/detection-rules/f1408a58-0e94-4165-b80a-da9f96cf6fc3.json","kind":"sigma"}