Abuse of osascript to Invoke Interactive Bash Shells on macOS

Adversaries targeting macOS systems may leverage the built-in osascript utility to execute AppleScript commands that invoke secondary processes, specifically interactive Bash shells. By passing bash commands with the "-i" flag to osascript, an attacker can maintain an interactive session for remote command execution, credential harvesting, or further lateral movement. This technique is often used during the post-exploitation phase to bypass standard execution restrictions or to hide malicious activity within the context of legitimate scripting environments. Defenders must monitor for osascript invocations that spawn shells, as this behavior deviates from typical system management utility usage.

Attack Chain

1. An attacker gains initial access to a macOS system via spearphishing or exploit.
2. The attacker identifies the target binary, osascript, which is a native tool used to execute AppleScript.
3. The attacker crafts a payload that executes a shell command via osascript.
4. The command line includes the arguments "bash" and "-i", forcing an interactive session.
5. The osascript process is executed by the system or user context.
6. A bash process is spawned as a child of the osascript utility.
7. The attacker interacts with the shell to execute arbitrary commands or download additional tools.

Impact

Successful exploitation allows for persistent unauthorized access to the host, sensitive data exfiltration, and the ability to execute further malicious code with the permissions of the compromised user or process.

Recommendation

1. Deploy the Sigma rule below to monitor for suspicious process-creation events involving osascript and interactive shells.
2. Monitor osquery results specifically for process trees where osascript is the parent or initiator of shell-related processes (bash, zsh).
3. Establish a baseline for administrative and MDM-related osascript usage to reduce noise and identify legitimate automation workflows.