Osacompile Execution By Potentially Suspicious Applet/Osascript

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•35

Detects the execution of 'osacompile' by potentially suspicious parent processes such as 'applet' or 'osascript'. This activity can indicate an attempt to compile AppleScript or JavaScript for Automation (JXA) code, which adversaries might use for execution or obfuscation.