AppleScript Payload Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•8

This rule detects the delivery of an AppleScript payload over HTTP. It specifically looks for HTTP responses (flow:to_client) that contain the string ".scpt" (case-insensitive) in the HTTP URI. This indicates a potential malicious script being downloaded to a client system, often used for execution on macOS systems.