Techniques › T1059.005 › AN0210
AN0210 Analytic 0210
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects embedded or emulated VBScript/VBA execution via Wine-based apps, Office for Mac abusing cross-platform .NET features, or macros dropped and invoked via AppleScript or third-party automation tools.</p>
- Detects
- T1059.005 Visual Basic
- Part of
- DET0076 Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | log stream --predicate 'eventMessage contains "wscript" OR "vbs"' | DC0029 Script Execution |
| macos:osquery | process_events | DC0032 Process Creation |
| macos:syslog | system.log | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ScriptLocation | Script run from ~/Downloads, ~/Library, or /tmp/ |
EmulationContext | Wine or CrossOver launching legacy Windows scripting engines. |
UserContext | VB execution from non-standard or shared users on endpoint. |