AppleScript (MITRE ATT&CK T1059.002) is an execution technique for macOS. AppleScript is a built in scripting language that controls applications and parts of the operating system by sending AppleEvents. Adversaries use the same features for their own ends.
How attackers use it
Scripts can run from the command line with osascript, using a script file or the -e option. They can also be started from Mail rules, Calendar alarms and Automator workflows, or run as a plain text shell script by starting the file with the osascript interpreter line.
AppleScript does not always need osascript. Mach-O binaries can call the NSAppleScript or OSAScript native APIs, which run code without the command line utility.
MITRE says AppleScript can locate open windows, send keystrokes, interact with an open SSH connection, move to remote machines and present users with fake dialog boxes. On macOS 10.10 and later it can also call native APIs without compiling a binary. Remote events cannot start applications, but they can interact with ones already running.
How to detect it
MITRE's detection strategy watches the causal chain: osascript or the NSAppleScript and OSAScript APIs, osascript spawning child processes, script-induced keystrokes, and API-backed dialog spoofing. Review where the parent process is not a user-facing app, and look for osascript launched from persistence mechanisms.
How to reduce the risk
- Code signing: require AppleScript to be signed by a trusted developer ID, which subjects it to the same Gatekeeper scrutiny as app bundles.
- Execution prevention: use application control where it is appropriate.
Quick check
Does blocking osascript stop all AppleScript execution?
No. Binaries can use NSAppleScript or OSAScript, so monitoring should cover those APIs too.
Sources
- MITRE ATT&CK, AppleScript: https://attack.mitre.org/techniques/T1059/002
