OSACompile Run-Only Execution

Title: OSACompile Run-Only Execution
Status: test
Description:Detects potential suspicious run-only executions compiled using OSACompile
References:
  -https://redcanary.com/blog/applescript/
  -https://ss64.com/osx/osacompile.html
Author: Sohan G (D4rkCiph3r)
Date: 2023-01-31
modified:None
Tags:

• -'attack.t1059.002'
• -'attack.execution'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection:
    CommandLine|contains|all:
      -'osacompile'
      -' -x '
      -' -e '

  condition:selection
Falsepositives:
  -Unknown
Level: high