Meow RAT C2 osascript Dispatch - AppleScript Shell Execution on macOS

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects suspicious execution of 'osascript' by processes that are not typically user-interactive, often indicative of C2 command dispatch or malicious AppleScript execution. The rule specifically looks for 'osascript' being spawned by processes other than common user applications (Finder, Terminal, iTerm2, etc.) or Apple-related processes, and checks for command-line arguments associated with executing shell commands via AppleScript or direct shell command execution patterns.