Analytics BIOC Low
✕

Rare process executed by an AppleScript

An uncommon process has been executed by the AppleScript interpreter process.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002)
Detector tags: AppleScript Analytics
Attacker's goals:

Use the AppleScript interpreter to execute a second-stage payload.

Investigative actions:

Analyze the AppleScript and executed process to determine whether they perform any malicious or suspicious actions. Check the events generated by the process or its children for potential malicious behavior. Check whether the AppleScript was executed in an unusual way.

Test period:
N/A (single event)
Deduplication:
1 Day