osascript privilege escalation via 'do shell script ... with administrator privileges'

Ethan Andrews@eandrews

•updated Jul 24, 2026•21•0•9

Detects osascript executing AppleScript containing 'do shell script ... with administrator privileges' to elevate execution, where the osascript process was spawned by a non-shell parent process, consistent with the EtherHiding macOS loader technique.