JXA In-memory Execution Via OSAScript

Title: JXA In-memory Execution Via OSAScript
Status: test
Description:Detects possible malicious execution of JXA in-memory via OSAScript
References:
  -https://redcanary.com/blog/applescript/
Author: Sohan G (D4rkCiph3r)
Date: 2023-01-31
modified:None
Tags:

• -'attack.t1059.002'
• -'attack.t1059.007'
• -'attack.execution'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection_main:
    CommandLine|contains|all:
      -'osascript'
      -' -e '
      -'eval'
      -'NSData.dataWithContentsOfURL'

  selection_js:
    - CommandLine|contains|all:
      - ' -l '
      - 'JavaScript'
CommandLine|contains:'.js'   condition:all of selection_*
Falsepositives:
  -Unknown
Level: high