{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/osascript/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["macos","lotl","c2","osascript"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries targeting macOS environments may abuse the native \u003ccode\u003eosascript\u003c/code\u003e utility to execute AppleScript, facilitating various post-exploitation activities including the establishment of persistent command-and-control (C2) or remote connections. Because \u003ccode\u003eosascript\u003c/code\u003e is a built-in utility, its use is common in administrative scripting and automation, making it a \u0026quot;living-off-the-land\u0026quot; (LotL) binary. This detection identifies anomalous activity where \u003ccode\u003eosascript\u003c/code\u003e initiates network connections that persist for an unusually long duration, specifically exceeding 10 minutes (600 seconds). By leveraging Cisco Network Visibility Module (NVM) flow data, defenders can baseline expected script behavior and flag outliers that may indicate established beaconing or unauthorized remote access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful abuse of \u003ccode\u003eosascript\u003c/code\u003e for long-term C2 can lead to persistent unauthorized access to macOS endpoints, facilitating data exfiltration, lateral movement, or further payload deployment. Because the connection is persistent, it increases the likelihood of data staging and successful exfiltration before detection.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDetection engineering teams should implement monitoring for long-lived processes using the Cisco Network Visibility Module.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule (or equivalent SIEM logic) to monitor Cisco NVM flow data for \u003ccode\u003eosascript\u003c/code\u003e processes with durations exceeding 600 seconds.\u003c/li\u003e\n\u003cli\u003eBaseline current organizational use of \u003ccode\u003eosascript\u003c/code\u003e within administrative workflows to identify and filter out legitimate long-running scripts, reducing false positives.\u003c/li\u003e\n\u003cli\u003eIntegrate flow data with endpoint process telemetry to provide context on the parent process that invoked \u003ccode\u003eosascript\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-21T19:09:26Z","date_published":"2026-09-21T19:09:26Z","id":"https://feed.craftedsignal.io/briefs/2026-09-osascript-long-duration/","summary":"Adversaries may abuse the native 'osascript' utility on macOS to establish long-lived command-and-control channels or remote network connections, which can be identified by analyzing flow duration metadata.","title":"Detecting Long-Duration Network Connections via macOS Osascript","url":"https://feed.craftedsignal.io/briefs/2026-09-osascript-long-duration/"}],"language":"en","title":"CraftedSignal Threat Feed - Osascript","version":"https://jsonfeed.org/version/1.1"}