Analytics BIOC
Informational
✕
AppleScript interpreter dynamic library loaded into a process
The AppleScript interpreter dynamic library was loaded into a process.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002)
Detector tags: AppleScript Analytics
Attacker's goals:
Stealthily execute AppleScript code while evading script-based detections.
Investigative actions:
Analyze the process and determine whether it performs any malicious or suspicious actions. Check the events generated by the process for potential malicious behavior. Check whether the process was executed in an unusual way.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- AppleScript interpreter dynamic library loaded into an unsigned applet Low (parent: Informational)
- AppleScript interpreter dynamic library loaded into a process with an uncommon vendor signature Low (parent: Informational)