Suspicious Child Process from macOS Script Editor
This rule detects when the macOS Script Editor application spawns child processes that are commonly used for malicious activities. Specifically, it looks for the Script Editor launching shell interpreters (bash, sh, zsh, dash, fish), scripting languages (python, perl, php, osascript), or utilities often leveraged in attack chains (curl, mktemp, chmod, nohup, openssl, plutil, PlistBuddy, xattr, sqlite, funzip, popen). This behavior can indicate an adversary using AppleScript or other scripting capabilities within Script Editor to execute arbitrary commands, download payloads, or manipulate system configurations.
Sigma
