Analytics BIOC
Low
✕
Uncommon AppleScript containing a potential obfuscation technique was executed
The AppleScript interpreter process was executed with an obfuscation technique in the command line.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002) Defense Evasion (TA0005)
ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Obfuscated Files or Information: Command Obfuscation (T1027.010)
Detector tags: AppleScript Analytics Evasion Analytics
Attacker's goals:
Evade defenses and impede forensics by encrypting, encoding, or obfuscating payloads at rest or in transit.
Investigative actions:
Analyze the command line and determine whether it performs any malicious or suspicious actions. Check the events generated by the process or its children for potential malicious behavior. Verify the legitimacy of the persistence mechanism being created or modified.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- Uncommon AppleScript containing a potential obfuscation technique was executed subsequently running a shell command Medium (parent: Low)
- Uncommon AppleScript containing a potential obfuscation technique was executed by an uncommon parent process High (parent: Low)