Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • AppleScript executed a shell script Informational 2 variations

    An uncommon shell script has been executed by the AppleScript interpreter process.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Command and Scripting Interpreter: Unix Shell (T1059.004)
    Required data: XDR Agent
    Detector tags: AppleScript Analytics, Shell Analytics
    Attacker's goals: Use the AppleScript interpreter to execute a second stage payload.
    Investigative actions: Analyze both the AppleScript and executed shell script to determine whether they perform malicious actions. Check the events generated by the process or its children for potential malicious behavior. Check whether the script was executed in an unusual way.

    Variations

    AppleScript executed a shell script using an unsigned, globally rare causality actor

    Low overridden

    An uncommon shell script has been executed by the AppleScript interpreter process. overridden

    AppleScript executed a shell script using an uncommon shell process

    Low overridden

    An uncommon shell script has been executed by the AppleScript interpreter process. overridden