Osascript

Adversaries may abuse the native 'osascript' utility on macOS to establish long-lived command-and-control channels or remote network connections, which can be identified by analyzing flow duration metadata.