AN0734 Analytic 0734

macOS · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.</p>

Detects: T1059.007 JavaScript
Part of: DET0264 Cross-Platform Detection of JavaScript Execution Abuse

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
macos:unifiedlog	`log stream with predicate 'eventMessage CONTAINS "osascript"'`	DC0029 Script Execution
macos:osquery	`process_events`	DC0032 Process Creation
macos:syslog	`/var/log/system.log`	DC0064 Command Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`ScriptLocation`	Execution of JXA from user-controlled paths like ~/Downloads or /Volumes.
`ParentProcess`	osascript invoked by third-party apps (VSCode, browsers, etc.).
`APIInvocation`	Use of OSAKit API by apps not typically scripting-enabled.

KEV CVEs whose mapped technique this analytic detects

CVE	Vendor / product	State
CVE-2013-3346	Adobe Reader and Acrobat	Mapped
CVE-2015-5119	Adobe Flash Player	Mapped
CVE-2018-4990	Adobe Acrobat and Reader	Mapped
CVE-2021-21148	Google Chromium V8	Mapped
CVE-2021-21166	Google Chromium	Mapped
CVE-2021-21206	Google Chromium Blink	Mapped
CVE-2021-30554	Google Chromium WebGL	Mapped
CVE-2021-37975	Google Chromium V8	Mapped
CVE-2022-22963	VMware Tanzu Spring Cloud	Mapped
CVE-2022-24682	Synacor Zimbra Collaborate Suite (ZCS)	Mapped
CVE-2023-22515	Atlassian Confluence Data Center and Server	Mapped
CVE-2023-26360	Adobe ColdFusion	Mapped
CVE-2023-5631	Roundcube Webmail	Mapped
CVE-2025-34028	Commvault Command Center	Mapped