| elastic |
Potential Prompt Injection Coercing Shell Execution |
production |
2026-10-09 |
| splunk |
MacOS Osascript Displaying Suspicious User Prompt |
production |
2026-10-02 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| splunk |
Cisco NVM - Osascript Network Connection for a Long Duration |
production |
2026-09-22 |
| elastic |
Prompt for Credentials with Osascript |
production |
2026-09-18 |
| elastic |
Suspicious Installer Package Spawns Network Event |
production |
2026-09-18 |
| elastic |
Apple Script Execution followed by Network Connection |
production |
2026-09-18 |
| elastic |
Shell Execution via Apple Scripting |
production |
2026-09-18 |
| elastic |
Suspicious macOS MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Jamf Endpoint |
production |
2026-09-18 |
| elastic |
Creation of Hidden Login Item via Apple Script |
production |
2026-09-18 |
| elastic |
Suspicious Emond Child Process |
production |
2026-09-18 |
| elastic |
Apple Scripting Execution with Administrator Privileges |
production |
2026-09-18 |
| elastic |
Execution with Explicit Credentials via Scripting |
production |
2026-09-18 |
| splunk |
MacOS Osascript Executing Interactive Shell |
production |
2026-09-18 |
| splunk |
MacOS Osascript Executing JavaScript Code With ObjC |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution by Zoom |
production |
2026-09-18 |
| elastic |
Execution via GitHub Actions Runner |
production |
2026-09-18 |
| elastic |
Suspicious AWS S3 Connection via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential EtherHiding C2 via Curl JSON-RPC Request |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Suspicious Browser Child Process |
production |
2026-09-18 |
| splunk |
MacOS AppleScript Shell Execution and Compilation |
production |
2026-09-03 |
| sigma |
Clipboard Access Via OSAScript |
test |
2026-05-22 |
| sigma |
MacOS Scripting Interpreter AppleScript |
test |
2026-05-21 |
| splunk |
MacOS AMOS Stealer - Virtual Machine Check Activity |
production |
2026-05-13 |
| sigma |
Axios NPM Compromise Indicators - macOS |
experimental |
2026-04-01 |
| sigma |
Atomic MacOS Stealer - FileGrabber Activity |
experimental |
2025-11-22 |
| sigma |
Osacompile Execution By Potentially Suspicious Applet/Osascript |
test |
2023-04-03 |
| sigma |
Suspicious Microsoft Office Child Process - MacOS |
test |
2023-02-04 |
| sigma |
JXA In-memory Execution Via OSAScript |
test |
2023-01-31 |
| sigma |
OSACompile Run-Only Execution |
test |
2023-01-31 |
| sigma |
Suspicious Execution via macOS Script Editor |
test |
2022-12-28 |