Analytics BIOC
Low
✕
Uncommon AppleScript containing a potential persistence command was executed via the command line
The AppleScript interpreter executed an uncommon command potentially used for persistence to maintain system access.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002) Persistence (TA0003)
ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Boot or Logon Autostart Execution (T1547)
Detector tags: AppleScript Analytics Generic Persistence Analytics
Attacker's goals:
Establish persistence on the system through various mechanisms to maintain access.
Investigative actions:
Analyze the command line and determine whether it performs any malicious or suspicious actions. Check the events generated by the process or its children for potential malicious behavior. Verify the legitimacy of the persistence mechanism being created or modified.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- Uncommon AppleScript containing a potential persistence command was executed via the command line targeting a .plist file for modification High (parent: Low) Adds Create or Modify System Process: Launch Agent (T1543.001) Create or Modify System Process: Launch Daemon (T1543.004)
- Uncommon AppleScript containing a potential persistence command was executed via the command line targeting launchctl load command execution Low Adds Create or Modify System Process: Launch Agent (T1543.001) Create or Modify System Process: Launch Daemon (T1543.004)