JXA In-memory Execution Via OSAScript
Detects possible malicious execution of JavaScript for Automation (JXA) in-memory via the `osascript` utility on macOS. This rule specifically looks for command-line executions of `osascript` that include the `-e` flag (for executing a script string), the `eval` function, `NSData.dataWithContentsOfURL` (indicating potential remote content loading), and either explicitly specifies 'JavaScript' as the language or includes '.js' in the command line.
Sigma
