Abuse of macOS osascript for JXA and Objective-C Bridge Execution

Adversaries frequently leverage the native macOS 'osascript' utility to execute AppleScript or JavaScript for Automation (JXA) code. By using the '-l JavaScript' flag, attackers can invoke JXA, which provides a powerful interface for interacting with macOS applications and system services. The inclusion of the Objective-C bridge within these scripts significantly expands this capability, allowing attackers to call native Objective-C APIs directly from JavaScript. This technique is often employed during the post-exploitation phase to perform activities such as credential theft, system manipulation, or persistent access to user data. Defenders should monitor for command-line arguments that combine the JavaScript interpreter flag with Objective-C bridge references, as this pattern is rarely seen in legitimate administrative activity and is highly indicative of malicious JXA usage.

Attack Chain

1. Attacker establishes initial access or presence on a macOS endpoint.
2. Attacker prepares a malicious script payload using JXA (JavaScript for Automation).
3. Attacker embeds Objective-C bridge calls within the JXA code to interface with native system APIs.
4. Attacker invokes 'osascript' with the '-l JavaScript' interpreter argument to execute the malicious script.
5. The 'osascript' process loads the required Objective-C bridge modules to interact with targeted system applications.
6. The script executes, enabling post-exploitation activities such as exfiltration of application data or system-level command execution.

Impact

Successful exploitation allows attackers to bypass standard sandbox protections by interacting directly with native macOS frameworks. This can lead to unauthorized access to sensitive user data, control over installed applications, and the potential for privilege escalation depending on the context of the running process, affecting any organization utilizing macOS devices for business operations.

Recommendation

Deploy process auditing on macOS endpoints to capture command-line activity for the 'osascript' binary. Use the following Sigma detection rule to alert on suspicious JXA execution patterns.

• Enable process auditing using macOS Endpoint Security or osquery to ensure process command-line arguments are recorded in your SIEM.
• Deploy the Sigma rule provided in this brief to your SIEM and tune for environment-specific administrative scripting.