From ded7ce26ca8c13a2ff05737e35d5b388fd0f16db Mon Sep 17 00:00:00 2001 From: Radka Date: Mon, 31 Aug 2026 16:49:03 +0200 Subject: [PATCH 1/3] initial commit --- ...ascript_prompting_for_user_interaction.yml | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml diff --git a/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml b/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml new file mode 100644 index 0000000000..2fef49df22 --- /dev/null +++ b/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml @@ -0,0 +1,67 @@ +name: MacOS Utility Osascript Prompting for User Interaction +id: d565ae18-7db6-460c-a2eb-a7109f18bc5e +version: 1 +creation_date: '2026-08-03' +modification_date: '2026-08-31' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: Utility osascript used "display dialog/alert" method, attempting to display fake system dialogs or credential prompts. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path="/usr/bin/osascript" Processes.process="*-e *" (Processes.process IN ("*display alert*", "*display dialog*", "*verify*", "*needs your attention*", "*critical update*", "*access System*", "*credentials*", "*password*", "*with hidden answer*", "*security update*", "*system error*", "*authentication*")) by Processes.dest Processes.user Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_utility_osascript_prompting_for_user_interaction_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative scripts or automation tools that use utility osascript for user interaction. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/tactics/TA0006/ + - https://attack.mitre.org/techniques/T1056/002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://www.loobins.io/binaries/osascript/ + - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1 + - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/ + - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious osascript dialog prompt detected on $dest$ +threat_objects: + - field: process_path + type: process +analytic_story: + - MacOS Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1056.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/d5155781a81a83ecf3fad40a7c19f16e5c856b22/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log + source: osquery + sourcetype: osquery:results + test_type: unit From 3931923049af87fc0c23635626040994338d5630 Mon Sep 17 00:00:00 2001 From: oerdogan Date: Mon, 31 Aug 2026 17:13:42 +0200 Subject: [PATCH 2/3] minor fixes --- ...ascript_prompting_for_user_interaction.yml | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml b/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml index 2fef49df22..76255d5720 100644 --- a/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml +++ b/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml @@ -10,7 +10,18 @@ description: Utility osascript used "display dialog/alert" method, attempting to data_source: - Osquery Results search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path="/usr/bin/osascript" Processes.process="*-e *" (Processes.process IN ("*display alert*", "*display dialog*", "*verify*", "*needs your attention*", "*critical update*", "*access System*", "*credentials*", "*password*", "*with hidden answer*", "*security update*", "*system error*", "*authentication*")) by Processes.dest Processes.user Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + FROM datamodel=Endpoint.Processes + WHERE Processes.process_name="osascript" + Processes.process="*-e *" + Processes.process IN ("*display alert*", "*display dialog*", "*verify*", "*needs your attention*", "*critical update*", "*access System*", "*credentials*", "*password*", "*with hidden answer*", "*security update*", "*system error*", "*authentication*") + BY Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_utility_osascript_prompting_for_user_interaction_filter` @@ -41,10 +52,10 @@ intermediate_findings: entities: - field: dest type: system - score: 20 - message: Suspicious osascript dialog prompt detected on $dest$ + score: 30 + message: Suspicious osascript dialog prompt via $process$ detected on $dest$ threat_objects: - - field: process_path + - field: process type: process analytic_story: - MacOS Privilege Escalation @@ -61,7 +72,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/d5155781a81a83ecf3fad40a7c19f16e5c856b22/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log source: osquery sourcetype: osquery:results test_type: unit From 262101218d606b21d99722a55b1c5bd29ea01cfc Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Sun, 6 Sep 2026 21:03:29 +0200 Subject: [PATCH 3/3] rename and slight logic/metadata change --- ...ipt_displaying_suspicious_user_prompt.yml} | 47 ++++++++++++++----- 1 file changed, 35 insertions(+), 12 deletions(-) rename detections/endpoint/{macos_utility_osascript_prompting_for_user_interaction.yml => macos_osascript_displaying_suspicious_user_prompt.yml} (63%) diff --git a/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml similarity index 63% rename from detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml rename to detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml index 76255d5720..b3a93b8066 100644 --- a/detections/endpoint/macos_utility_osascript_prompting_for_user_interaction.yml +++ b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml @@ -1,4 +1,4 @@ -name: MacOS Utility Osascript Prompting for User Interaction +name: MacOS Osascript Displaying Suspicious User Prompt id: d565ae18-7db6-460c-a2eb-a7109f18bc5e version: 1 creation_date: '2026-08-03' @@ -6,30 +6,53 @@ modification_date: '2026-08-31' author: Radka Viskova, Splunk status: production type: Anomaly -description: Utility osascript used "display dialog/alert" method, attempting to display fake system dialogs or credential prompts. +description: |- + The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content. + Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information. + This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity. data_source: - Osquery Results search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Processes - WHERE Processes.process_name="osascript" - Processes.process="*-e *" - Processes.process IN ("*display alert*", "*display dialog*", "*verify*", "*needs your attention*", "*critical update*", "*access System*", "*credentials*", "*password*", "*with hidden answer*", "*security update*", "*system error*", "*authentication*") - BY Processes.dest Processes.original_file_name Processes.parent_process_id + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process IN ( + "*display alert*", + "*display dialog*" + ) + Processes.process IN ( + "*access System*", + "*authentication*", + "*credentials*", + "*critical update*", + "*needs your attention*", + "*password*", + "*security update*", + "*system error*", + "*verify*", + "*with hidden answer*" + ) + + BY Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `macos_utility_osascript_prompting_for_user_interaction_filter` + | `macos_osascript_displaying_suspicious_user_prompt_filter` how_to_implement: |- This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: |- - Legitimate administrative scripts or automation tools that use utility osascript for user interaction. + Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity. references: - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0006/ @@ -52,8 +75,8 @@ intermediate_findings: entities: - field: dest type: system - score: 30 - message: Suspicious osascript dialog prompt via $process$ detected on $dest$ + score: 20 + message: The osascript utility executed a command containing dialog-related and potentially deceptive content on endpoint [$dest$] with the Command Line [$process$]. threat_objects: - field: process type: process