macOS detection: MacOS Osascript Displaying Suspicious User Prompt

detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml

@@ -0,0 +1,101 @@
+name: MacOS Osascript Displaying Suspicious User Prompt
+id: d565ae18-7db6-460c-a2eb-a7109f18bc5e
+version: 1
+creation_date: '2026-08-03'
+modification_date: '2026-08-31'
+author: Radka Viskova, Splunk
+status: production
+type: Anomaly
+description: |-
+    The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content.
+    Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information.
+    This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.
+data_source:
+    - Osquery Results
+search: |-
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+
+    FROM datamodel=Endpoint.Processes WHERE
+
+    Processes.process_name="osascript"
+    Processes.process IN (
+        "*display alert*",
+        "*display dialog*"
+    )
+    Processes.process IN (
+        "*access System*",
+        "*authentication*",
+        "*credentials*",
+        "*critical update*",
+        "*needs your attention*",
+        "*password*",
+        "*security update*",
+        "*system error*",
+        "*verify*",
+        "*with hidden answer*"
+    )
+
+    BY Processes.dest Processes.original_file_name Processes.parent_process_id
+       Processes.process Processes.process_exec Processes.process_guid
+       Processes.process_hash Processes.process_id
+       Processes.process_current_directory Processes.process_name
+       Processes.process_path Processes.user
+       Processes.user_id Processes.vendor_product
+
+    | `drop_dm_object_name(Processes)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `macos_osascript_displaying_suspicious_user_prompt_filter`
+how_to_implement: |-
+    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+known_false_positives: |-
+    Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity.
+references:
+    - https://attack.mitre.org/tactics/TA0002/
+    - https://attack.mitre.org/tactics/TA0006/
+    - https://attack.mitre.org/techniques/T1056/002/
+    - https://attack.mitre.org/techniques/T1059/002/
+    - https://www.loobins.io/binaries/osascript/
+    - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1
+    - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/
+    - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
+drilldown_searches:
+    - name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: The osascript utility executed a command containing dialog-related and potentially deceptive content on endpoint [$dest$] with the Command Line [$process$].
+threat_objects:
+    - field: process
+      type: process
+analytic_story:
+    - MacOS Privilege Escalation
+asset_type: Endpoint
+mitre_attack_id:
+    - T1059.002
+    - T1056.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log
+          source: osquery
+          sourcetype: osquery:results
+      test_type: unit