Rule Info
Name
Osacompile Execution By Potentially Suspicious Applet/Osascript
Author
Sohan G (D4rkCiph3r), Red Canary (Idea)
Description
Detects potential suspicious applet or osascript executing "osacompile".
Date
2023-04-03 00:00:00
Modified
None
Id
a753a6af-3126-426d-8bd0-26ebbcb92254
Tags
attack.execution attack.t1059.002
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
github-actions[bot]
Merge PR #4700 from @nasbench - Promote older rules status from `experimental` to `test`
2024-02-01
D4rkCiph3r
feat: new rule `proc_creation_macos_suspicious_applet_behaviour.yml` (#4126)
2023-04-03
Scan your endpoints, forensic images or collected files with our portable scanner THOR