Suspicious Execution via macOS Script Editor

Title: Suspicious Execution via macOS Script Editor
Status: test
Description:Detects when the macOS Script Editor utility spawns an unusual child process.
References:
  -https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685
  -https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/
Author: Tim Rauch (rule), Elastic (idea)
Date: 2022-10-21
modified:2022-12-28
Tags:

• -'attack.defense-impairment'
• -'attack.t1566'
• -'attack.t1566.002'
• -'attack.initial-access'
• -'attack.t1059'
• -'attack.t1059.002'
• -'attack.t1204'
• -'attack.t1204.001'
• -'attack.execution'
• -'attack.persistence'
• -'attack.t1553'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection_parent:
    ParentImage|endswith: '/Script Editor'
  selection_img:
    - Image|endswith:
      - '/curl'
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/dash'
      - '/fish'
      - '/osascript'
      - '/mktemp'
      - '/chmod'
      - '/php'
      - '/nohup'
      - '/openssl'
      - '/plutil'
      - '/PlistBuddy'
      - '/xattr'
      - '/sqlite'
      - '/funzip'
      - '/popen'
    - Image|contains:
      - 'python'
      - 'perl'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium