Name:MacOS Osascript Displaying Suspicious User Prompt id:d565ae18-7db6-460c-a2eb-a7109f18bc5e version:1 date:None author:Radka Viskova, Splunk status:production type:Anomaly Description:The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content.
Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information.
This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity. Data_source:
-Osquery Results
search:| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
how_to_implement:This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives:Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity. References: -https://attack.mitre.org/tactics/TA0002/ -https://attack.mitre.org/tactics/TA0006/ -https://attack.mitre.org/techniques/T1056/002/ -https://attack.mitre.org/techniques/T1059/002/ -https://www.loobins.io/binaries/osascript/ -https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1 -https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/ -https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ drilldown_searches: name:'View the detection results for - "$user$" and "$dest$"' search:'%original_detection_search% | search user = "$user$" dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$" and "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['MacOS Privilege Escalation']
