MacOS AppleScript Shell Execution and Compilation

Name:MacOS AppleScript Shell Execution and Compilation
id:ceee1f2b-4b40-4721-b91e-40d1134e9dc4
version:1
date:None
author:Radka Viskova, Splunk
status:production
type:Anomaly
Description:The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic. The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host. It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly. Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution.
Data_source:

• -Osquery Results

search:| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Processes WHERE

Processes.process_name IN ("osascript", "osacompile")
Processes.process="*do *"
Processes.process="* shell *"
Processes.process="* script*"

BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user
Processes.user_id Processes.vendor_product

| `drop_dm_object_name(Processes)`

| eval activity_type=case(
process_name="osascript", "AppleScript Shell Command Execution",
process_name="osacompile", "AppleScript Compilation or Staging"
)

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`

| table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product

| `macos_applescript_shell_execution_and_compilation_filter`

how_to_implement:This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models.
known_false_positives:Legitimate administrative scripts or automation tools using Applescript.
References:
  -https://attack.mitre.org/tactics/TA0002/
  -https://attack.mitre.org/techniques/T1059/002/
  -https://www.loobins.io/binaries/osascript/
  -https://redcanary.com/threat-detection-report/techniques/applescript/
drilldown_searches:
 name:'View the detection results for - "$user$" and "$dest$"'
 search:'%original_detection_search% | search user = "$user$" dest = "$dest$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$user$" and "$dest$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'7d'
 latest_offset:'0'
analytic_story:['MacOS Post-Exploitation']

asset_type:Endpoint

mitre_attack_id:['T1059.002']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:endpoint

security_domain:endpoint

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log
  source: osquery
  sourcetype: osquery:results
 test_type:'unit'
manual_test:None