Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
90 detections
Filters
Last updated
All Time
Detection languages
30
29
10
6
6
Contributors
21
16
10
6
6
Categories
57
50
43
13
13
Platforms
87
4
4
3
Products / Services
38
6
4
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
IDS Classtypes
2
IDS Protocols
1
1
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content.
Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information.
This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.
Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information.
This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.
Detects suspicious command-line execution patterns involving Unix shells (bash, zsh, sh) spawned from terminal applications where tools like curl or wget are piped directly into a shell, base64 decoding is performed, osascript executes dialogs, or quarantine attributes are removed.
This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds).
Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.
Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.
This analytic detects the macOS osascript utility being used with an interactive Bash invocation, identified by the presence
of "bash -i" in the command line.
Adversaries may abuse osascript and AppleScript's shell execution capabilities to launch
interactive shells, establish remote access, or execute post-exploitation commands.
of "bash -i" in the command line.
Adversaries may abuse osascript and AppleScript's shell execution capabilities to launch
interactive shells, establish remote access, or execute post-exploitation commands.
This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, identified by
the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and
Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or
perform post-exploitation activity.
the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and
Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or
perform post-exploitation activity.
This rule detects executions of the 'osascript' utility on macOS where the command line argument is exceptionally long and contains high entropy, suggesting the use of base64 or other encoding techniques to obfuscate malicious scripts or payloads.
Detects specific file hashes associated with Atomic macOS Stealer (AMOS) Mach-O payloads, which are often delivered via staging scripts on macOS systems.
The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic.
The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host.
It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly.
Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution.
The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host.
It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly.
Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution.
Detects an embedded AppleScript using Finder's 'duplicate' command to copy Safari cookies, Notes attachments, and the Keychains folder to a randomly named staging directory, avoiding direct TCC prompts as used by AmnesiaStealer.
This rule detects the use of 'osascript' on macOS to generate a fake credential prompt dialog. It specifically looks for AppleScript commands containing keywords such as 'display dialog', 'password', and either 'with hidden answer' or 'Enter your password'. This behavior is characteristic of an adversary attempting to phish user credentials by presenting a legitimate-looking prompt.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects the execution of AppleScript files (.scpt) using the osascript command-line utility on macOS. Adversaries often use AppleScript to execute commands, interact with applications, or perform malicious actions on a system.
Detects the creation and subsequent execution of AppleScript files (.scpt) using the 'osascript' command-line utility on macOS. This pattern is commonly used to automate tasks, but can be leveraged by attackers for malicious payload execution or system interaction.
Detects the use of 'curl' to perform a network request (likely for a remote script) and immediately piping that output to 'osascript' for execution in memory. This pattern is often used to execute malicious AppleScript payloads directly without writing to the disk, a technique seen in recent macOS infostealer campaigns.
This rule detects the execution of potentially malicious command-line patterns (involving base64 decoding, pipes to sh/zsh, and network-fetching utilities like curl) within Terminal.app processes on macOS. It correlates these command executions with prior web browser activity within a 5-minute window, effectively identifying potential 'ClickFix' social engineering lures where users are coerced into copying and pasting malicious instructions into their shell.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
This rule detects the use of 'osascript' on macOS to execute commands that interact with the 'AccountsHelper' process, specifically using 'stat' to probe /dev/console and 'sudo -u' for privilege elevation or user context switching. This pattern is indicative of unauthorized attempts to interact with system account management utilities or sensitive user processes.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Page 1 of 5