Osacompile Execution By Potentially Suspicious Applet/Osascript

Title: Osacompile Execution By Potentially Suspicious Applet/Osascript
Status: test
Description:Detects potential suspicious applet or osascript executing "osacompile".
References:
  -https://redcanary.com/blog/mac-application-bundles/
Author: Sohan G (D4rkCiph3r), Red Canary (Idea)
Date: 2023-04-03
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.002'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection:
    ParentImage|endswith:
      -'/applet'
      -'/osascript'

    CommandLine|contains: 'osacompile'
  condition:selection
Falsepositives:
  -Unknown
Level: medium