Detecting Long-Duration Network Connections via macOS Osascript

Adversaries targeting macOS environments may abuse the native osascript utility to execute AppleScript, facilitating various post-exploitation activities including the establishment of persistent command-and-control (C2) or remote connections. Because osascript is a built-in utility, its use is common in administrative scripting and automation, making it a "living-off-the-land" (LotL) binary. This detection identifies anomalous activity where osascript initiates network connections that persist for an unusually long duration, specifically exceeding 10 minutes (600 seconds). By leveraging Cisco Network Visibility Module (NVM) flow data, defenders can baseline expected script behavior and flag outliers that may indicate established beaconing or unauthorized remote access.

Impact

Successful abuse of osascript for long-term C2 can lead to persistent unauthorized access to macOS endpoints, facilitating data exfiltration, lateral movement, or further payload deployment. Because the connection is persistent, it increases the likelihood of data staging and successful exfiltration before detection.

Recommendation

Detection engineering teams should implement monitoring for long-lived processes using the Cisco Network Visibility Module.

• Deploy the provided Sigma rule (or equivalent SIEM logic) to monitor Cisco NVM flow data for osascript processes with durations exceeding 600 seconds.
• Baseline current organizational use of osascript within administrative workflows to identify and filter out legitimate long-running scripts, reducing false positives.
• Integrate flow data with endpoint process telemetry to provide context on the parent process that invoked osascript.