MacOS Osascript Executing Interactive Shell

Name:MacOS Osascript Executing Interactive Shell
id:01168215-d1c7-4a37-8bd3-c5b64664c947
version:1
date:None
author:Radka Viskova, Splunk
status:production
type:Anomaly
Description:This analytic detects the macOS osascript utility being used with an interactive Bash invocation, identified by the presence of "bash -i" in the command line. Adversaries may abuse osascript and AppleScript's shell execution capabilities to launch interactive shells, establish remote access, or execute post-exploitation commands.
Data_source:

• -Osquery Results

search:| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime

FROM datamodel=Endpoint.Processes WHERE

Processes.process_name="osascript"
Processes.process="*bash *"
Processes.process="* -i*"

BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user
Processes.user_id Processes.vendor_product

| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `macos_osascript_executing_interactive_shell_filter`

how_to_implement:This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives:Legitimate administrative scripts, MDM workflows, software deployment tools, developer automation, or support utilities may use osascript to invoke an interactive shell.
References:
  -https://attack.mitre.org/tactics/TA0002/
  -https://attack.mitre.org/techniques/T1059/002/
  -https://attack.mitre.org/techniques/T1059/004/
  -https://redcanary.com/threat-detection-report/techniques/applescript/
  -https://www.loobins.io/binaries/osascript/
drilldown_searches:
 name:'View the detection results for - "$user$" and "$dest$"'
 search:'%original_detection_search% | search user = "$user$" dest = "$dest$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$user$" and "$dest$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'7d'
 latest_offset:'0'
analytic_story:['MacOS Post-Exploitation']

asset_type:Endpoint

mitre_attack_id:['T1059.002', 'T1059.004']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:endpoint

security_domain:endpoint

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log
  source: osquery
  sourcetype: osquery:results
 test_type:'unit'
manual_test:None