Techniques › T1059 › T1059.002
T1059.002 AppleScript
execution — macOS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
9
Sigma rules tagged attack.t1059.002
0
KEV CVEs mapped here
<p>Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents. These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.</p><p>Scripts can be run from the command-line via <code>osascript /path/to/script</code> or <code>osascript -e "script here"</code>. Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding <code>#!/usr/bin/osascript</code> to the start of the script file.</p><p>AppleScripts do not need to call <code>osascript</code> to execute. However, they may be executed from within mach-O binaries by using the macOS Native APIs <code>NSAppleScript</code> or <code>OSAScript</code>, both of which execute code independent of the <code>/usr/bin/osascript</code> command line utility.</p><p>Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute Native APIs, which otherwise would require compilation and execution in a mach-O binary file format. Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via Python.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0414 Detection of AppleScript-Based Execution on macOS v1.0
AN1164 macOSDetects AppleScript execution via 'osascript', NSAppleScript/OSAScript APIs, and abnormal application control events across user sessions. Focuses on causal chains such as osascript spawning child processes, script-induced keystrokes, or API-backed dialog spoofing.Tunable:
ScriptInvocationParentTimeWindowAppleEventActionTypeTargetApplicationSetExecutionPathRegex
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1059.002
Author: Alejandro Ortuno, oscd.community
· 2020-10-21 (modified 2026-05-21) · logsource: product=macos category=process_creation · 1bc2e6c5-0885-472b-bed6-be5ea8eace55
Detects execution of AppleScript of the macOS scripting language AppleScript.
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 (modified 2023-02-04) · logsource: product=macos category=process_creation · 69483748-1525-4a6c-95ca-90dc8d431b68
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 (modified 2026-05-22) · logsource: product=macos category=process_creation · 7794fa3c-edea-4cff-bec7-267dd4770fd7
Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Author: Sohan G (D4rkCiph3r), Red Canary (Idea)
· 2023-04-03 · logsource: product=macos category=process_creation · a753a6af-3126-426d-8bd0-26ebbcb92254
Detects potential suspicious applet or osascript executing "osacompile".
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 · logsource: product=macos category=process_creation · b9d9b652-d8ed-4697-89a2-a1186ee680ac
Detects potential suspicious run-only executions compiled using OSACompile
Author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
· 2025-11-22 · logsource: product=macos category=process_creation · e710a880-1f18-4417-b6a0-b5afdf7e33da
Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. The rule identifies either the execution of FileGrabber targeting /tmp or the use of curl to POST sensitive user data (including files such as /tmp/out.zip) to remote servers, which are key indicators of Amos infostealer activity.
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 · logsource: product=macos category=process_creation · f1408a58-0e94-4165-b80a-da9f96cf6fc3
Detects possible malicious execution of JXA in-memory via OSAScript
Rules tagged at the parent level (attack.t1059) 95
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-03-22 · logsource: product=windows category=process_creation · 24474469-bd80-46cc-9e08-9fbe81bfaaca
Detects the execution of a Word document via the WinWord Start Menu shortcut.
This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.
Author: Florian Roth (Nextron Systems)
· 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Author: Bhabesh Raj
· 2021-09-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 245f92e3-c4da-45f1-9070-bc552e06db11
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
Author: Florian Roth (Nextron Systems), wagga
· 2020-12-23 (modified 2023-03-10) · logsource: product=windows category=process_creation · 24c4d154-05a4-4b99-b57d-9b977472443a
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
Author: X__Junior (Nextron Systems)
· 2024-03-11 · logsource: product=windows category=process_creation · 264982dc-dbad-4dce-b707-1e0d3e0f73d9
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
· 2025-12-05 · logsource: product=windows category=process_creation · 271de298-cc0e-4842-acd8-079a0a99ea65
Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell).
Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync().
If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked.
For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2023-02-03) · logsource: product=windows category=process_creation · 277a4393-446c-449a-b0ed-7fdc7795244c
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Author: Florian Roth
· 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-31 (modified 2023-05-15) · logsource: product=windows category=process_creation · 2c28c248-7f50-417a-9186-a85b223010ee
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 2d2f44ff-4611-4778-a8fc-323a0e9850cc
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
Author: Sreeman, Florian Roth (Nextron Systems), frack113
· 2020-04-21 (modified 2023-04-17) · logsource: product=windows category=process_creation · 313d6012-51a0-4d93-8dfc-de8553239e25
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
Author: @kostastsale
· 2023-06-01 · logsource: product=windows category=process_creation · 39ac1fb0-07f1-474b-b97e-c5c0eace0d79
Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.
MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll.
Hunting Opportunity
Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-08-25 (modified 2023-03-05) · logsource: product=windows category=process_creation · 42333b2c-b425-441c-b70e-99404a17170f
Detects process activity patterns as seen being used by Sliver C2 framework implants
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 47b3bbd4-1bf7-48cc-84ab-995362aaa75a
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Nextron Systems
· 2022-06-03 · logsource: product=windows category=process_creation · 480e7e51-e797-47e3-8d72-ebfce65b6d8d
Detects python spawning a pretty tty
Author: Tim Rauch, Elastic (idea)
· 2022-09-21 (modified 2023-12-05) · logsource: product=windows category=process_creation · 4b991083-3d0e-44ce-8fc4-b254025d8d4b
Detects suspicious parent process for cmd.exe
Author: @d4ns4n_
· 2023-04-24 · logsource: product=linux category=process_creation · 4e25af4b-246d-44ea-8563-e42aacab006b
Detects usage of "xterm" as a potential reverse shell tunnel
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 540703fb-a874-4385-a9d6-7cd1bfab268c
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
· 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · 55f0a3a1-846e-40eb-8273-677371b8d912
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Author: bohops, Bhabesh Raj
· 2021-10-08 (modified 2023-07-25) · logsource: product=windows category=process_creation · 5687f942-867b-4578-ade7-1e341c46e99a
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
Author: Ján Trenčanský
· 2020-07-28 · logsource: product=windows service=windefend · 57b649ef-ff42-4fb0-8bf6-62da243a1708
Detects actions taken by Windows Defender malware detection engines
Author: Florian Roth (Nextron Systems)
· 2021-07-03 (modified 2022-05-20) · logsource: product=windows category=process_creation · 5de632bc-7fbd-4c8a-944a-fce55c59eae5
Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-11-23 (modified 2025-03-06) · logsource: product=windows category=process_creation · 61065c72-5d7d-44ef-bf41-6a36684b545f
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-25 (modified 2024-07-12) · logsource: product=windows category=process_creation · 69bd9b97-2be2-41b6-9816-fb08757a4d1a
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Author: juju4
· 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e
Detects suspicious process related to rasdial.exe
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=file_event · 6e90ae7a-7cd3-473f-a035-4ebb72d961da
Detects processes creating temp files related to PCRE.NET package
Author: Austin Songer
· 2021-09-21 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 72af37e2-ec32-47dc-992b-bc288a2708cb
Identifies when a new cloudshell is created inside of Azure portal.
Author: X__Junior (Nextron Systems)
· 2023-09-11 (modified 2023-10-12) · logsource: product=windows category=process_creation · 7530cd3d-7671-43e3-b209-976966f6ea48
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Author: X__Junior (Nextron Systems)
· 2023-07-11 · logsource: product=windows category=image_load · 799a5f48-0ac1-4e0f-9152-71d137d48c2a
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Author: pH-T (Nextron Systems)
· 2023-04-17 (modified 2024-11-23) · logsource: product=windows category=process_creation · 7a4d9232-92fc-404d-8ce1-4c92e7caf539
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
Author: @kostastsale
· 2023-07-16 · logsource: product=windows category=process_creation · 7aaa5739-12fc-41aa-b98b-23ec27d42bdf
Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.
Author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux
· 2022-12-28 (modified 2026-06-05) · logsource: product=linux category=process_creation · 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
· 2023-04-07 · logsource: product=linux category=process_creation · 7f734ed0-4f47-46c0-837f-6ee62505abd9
Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-03 · logsource: product=linux category=process_creation · 7fb14105-530e-4e2e-8cfb-99f7d8700b66
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134
Author: Rafal Piasecki
· 2022-08-10 (modified 2026-03-30) · logsource: product=linux service=auditd · 808146b2-9332-4d78-9416-d7e47012d83d
detects BPFDoor .lock and .pid files access in temporary file storage facility
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-16 · logsource: product=windows category=process_creation · 814c95cc-8192-4378-a70a-f1aafd877af1
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=image_load · 84b0a8f3-680b-4096-a45b-e9a89221727c
Detects processes loading modules related to PCRE.NET package
Author: Florian Roth (Nextron Systems)
· 2022-03-24 (modified 2025-07-18) · logsource: product=windows category=process_creation · 85b0b087-eddf-4a2b-b033-d771fa2b9775
Detects PowerShell download and execution cradles.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-08-29 · logsource: product=linux category=process_creation · 8737b7f6-8df3-4bb7-b1da-06019b99b687
Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Florian Roth (Nextron Systems), @neonprimetime
· 2021-09-08 (modified 2023-02-04) · logsource: product=windows category=process_creation · 894397c6-da03-425c-a589-3d09e7d1f750
Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 (modified 2025-10-07) · logsource: product=windows category=process_creation · 899133d5-4d7c-4a7f-94ee-27355c879d90
Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 8c1a5675-cb85-452f-a298-b01b22a51856
Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function.
This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Micah Babinski
· 2025-11-25 · logsource: product=windows category=process_creation · 8e95e73e-ba02-4a87-b4d7-0929b8053038
Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.
ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS
Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding
service endpoint and remotely execute code from the ArcSOC.exe process.
Author: @kostastsale
· 2023-02-15 (modified 2024-08-13) · logsource: product=windows category=process_creation · 95724fc1-a258-4674-97db-a30351981c5a
This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries.
From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios.
1. Compressed file opened using 7zip.
2. Compressed file opened using WinRar.
3. Compressed file opened using native windows File Explorer capabilities.
When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."
Author: Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2024-03-05) · logsource: product=windows category=process_creation · 9aa5106d-bce3-4b13-86df-3a20f1d5cf0b
Detects the execution of "forfiles" with the "/c" flag.
While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary.
Can be used to bypass application whitelisting.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2022-02-15 (modified 2023-03-06) · logsource: product=windows category=process_creation · a77c1610-fc73-4019-8e29-0f51efc04a51
Detects possible payload obfuscation via the commandline
Author: Sreeman
· 2020-04-21 (modified 2022-03-08) · logsource: product=windows category=process_creation · ae9b0bd7-8888-4606-b444-0ed7410cb728
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
Author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-12-15 (modified 2024-01-02) · logsource: product=windows category=process_creation · afe52666-401e-4a02-b4ff-5d128990b8cb
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-02 (modified 2024-04-23) · logsource: product=windows category=process_creation · b96b2031-7c17-4473-afe7-a30ce714db29
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-05 · logsource: product=windows category=file_event · bbb7e38c-0b41-4a11-b306-d2a457b7ac2b
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-02 (modified 2023-02-14) · logsource: product=windows category=process_creation · bdeeabc9-ff2a-4a51-be59-bb253aac7891
Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)
Author: frack113, The DFIR Report
· 2022-03-02 (modified 2025-11-13) · logsource: product=windows category=process_creation · c0b2768a-dd06-4671-8339-b16ca8d1f27f
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Author: Tim Rauch, Elastic (idea)
· 2022-09-16 (modified 2022-11-26) · logsource: product=windows category=ps_script · c1344fa2-323b-4d2e-9176-84b4d4821c88
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 (modified 2023-12-04) · logsource: product=windows category=process_creation · c15a46a0-07d4-4c87-b4b6-89207835a83b
Detects usage of winget to add new potentially suspicious download sources
Author: Nextron Systems
· 2022-06-03 (modified 2024-11-04) · logsource: product=linux category=process_creation · c4042d54-110d-45dd-a0e1-05c47822c937
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Author: Markus Neis
· 2017-11-07 (modified 2022-10-09) · logsource: product=windows category=process_creation · c601f20d-570a-4cde-a7d6-e17f99cb8e7f
Detects automated lateral movement by Turla group
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
· 2025-12-05 · logsource: product=linux category=process_creation · c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).
This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.
When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).
For other methods, the Image field will show the spawned process directly.
Author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community
· 2020-10-17 (modified 2021-11-27) · logsource: product=windows category=process_creation · c83bf4b5-cdf0-437c-90fa-43d734f7c476
Detects PowerShell script execution via input stream redirect
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 (modified 2025-03-06) · logsource: product=windows category=process_creation · cbb9e3d1-2386-4e59-912e-62f1484f7a89
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-03 · logsource: product=linux category=process_creation · d292e0af-9a18-420c-9525-ec0ac3936892
Detects java process spawning suspicious children
Author: Florian Roth (Nextron Systems)
· 2018-06-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · d81871ef-5738-47ab-9797-7a9c90cd4bfb
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · db1ac3be-f606-4e3a-89e0-9607cbe6b98a
Detects the use of the "capsh" utility to invoke a shell.
Author: Tomasz Dyduch, Josh Nickels
· 2024-05-31 · logsource: product=windows category=file_event · df49c691-8026-48dd-94d3-4ba6a79102a8
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
· 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · e212d415-0e93-435f-9e1a-f29005bb4723
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth
· 2024-09-02 (modified 2025-01-18) · logsource: product=linux category=process_creation · e2326866-609f-4015-aea9-7ec634e8aa04
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Bhabesh Raj
· 2020-09-14 (modified 2022-12-07) · logsource: product=windows service=windefend · ea9bf0fa-edec-4fb8-8b78-b119f2528186
Detects triggering of AMSI by Windows Defender.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2022-07-11) · logsource: product=windows category=process_creation · eca49c87-8a75-4f13-9c73-a5a29e845f03
Detects execution of powershell scripts via Runscripthelper.exe
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-10 · logsource: product=windows category=process_creation · eca8ae39-5c3c-4321-b538-9e64fe25822e
Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Author: Florian Roth (Nextron Systems)
· 2022-02-11 (modified 2023-03-22) · logsource: product=windows category=process_creation · efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-07-27 (modified 2023-03-29) · logsource: product=windows category=process_creation · f35c5d71-b489-4e22-a115-f003df287317
Detects potential process patterns related to Cobalt Strike beacon activity
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · f426547a-e0f7-441a-b63e-854ac5bdf54d
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=linux category=process_creation · f8987c03-4290-4c96-870f-55e75ee377f4
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: frack113
· 2022-03-12 · logsource: product=windows category=process_creation · f8ad2e2c-40b6-4117-84d7-20b89896ab23
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=process_creation · f8e9aa1c-14f2-4dbd-aa59-b98968ed650d
Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within
the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate
command-and-control server.
Author: X__Junior
· 2025-01-20 · logsource: product=windows category=image_load · fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.