osascript abuse

AppleScript (osascript) used for shell execution, privilege escalation, or keystroke injection — a common macOS living-off-the-land execution technique.

• T1059.002Command and Scripting Interpreter: AppleScript· Execution

Some admin tooling and installers legitimately use osascript. Judge by the invoking process, the script body, and whether privileges are requested.

Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/macos/osascript_abuse.yaml, licensed under the Apache License 2.0.

id: macos.execution.osascript_abuse
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [macos]
mitre_techniques: [T1059.002]
description: |
  AppleScript (osascript) used for shell execution, privilege escalation, or
  keystroke injection — a common macOS living-off-the-land execution technique.
match:
  raw_message_regex: '(?i)osascript\b.*(do shell script|with administrator privileges|keystroke|System Events)'
false_positive_guidance: |
  Some admin tooling and installers legitimately use osascript. Judge by the
  invoking process, the script body, and whether privileges are requested.

• Curl pipe to shellSeverity high
• Dual use admin toolSeverity medium
• Known offensive toolSeverity high
• Reverse shellSeverity critical
• Reverse shell auditdSeverity critical
• Encoded PowerShell CommandSeverity high