Osascript executing .scpt file with subsequent network connection (JXA stager)

Duo Tech@duotech

•updated Jul 6, 2026•3•0•5

Detects the execution of an AppleScript file via the osascript utility that initiates a network connection within a 5-minute window of execution. This behavior is often indicative of automated script-based network activity, such as command-and-control communication or data exfiltration.