AppleScript Remote Execution via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to execute AppleScript commands remotely over SSH. It specifically looks for the string "osascript" (case-insensitive) within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential remote execution of AppleScript.