Analytics BIOC
Informational
✕
AppleScript executed a shell script
An uncommon shell script has been executed by the AppleScript interpreter process.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Command and Scripting Interpreter: Unix Shell (T1059.004)
Detector tags: AppleScript Analytics Shell Analytics
Attacker's goals:
Use the AppleScript interpreter to execute a second stage payload.
Investigative actions:
Analyze both the AppleScript and executed shell script to determine whether they perform malicious actions. Check the events generated by the process or its children for potential malicious behavior. Check whether the script was executed in an unusual way.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- AppleScript executed a shell script using an unsigned, globally rare causality actor Low (parent: Informational)
- AppleScript executed a shell script using an uncommon shell process Low (parent: Informational)