Osascript - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/osascript/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 21 Sep 2026 19:09:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetecting Long-Duration Network Connections via macOS Osascripthttps://feed.craftedsignal.io/briefs/2026-09-osascript-long-duration/Mon, 21 Sep 2026 19:09:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-osascript-long-duration/Adversaries may abuse the native 'osascript' utility on macOS to establish long-lived command-and-control channels or remote network connections, which can be identified by analyzing flow duration metadata.Adversaries targeting macOS environments may abuse the native osascript utility to execute AppleScript, facilitating various post-exploitation activities including the establishment of persistent command-and-control (C2) or remote connections. Because osascript is a built-in utility, its use is common in administrative scripting and automation, making it a "living-off-the-land" (LotL) binary. This detection identifies anomalous activity where osascript initiates network connections that persist for an unusually long duration, specifically exceeding 10 minutes (600 seconds). By leveraging Cisco Network Visibility Module (NVM) flow data, defenders can baseline expected script behavior and flag outliers that may indicate established beaconing or unauthorized remote access.

Impact

Successful abuse of osascript for long-term C2 can lead to persistent unauthorized access to macOS endpoints, facilitating data exfiltration, lateral movement, or further payload deployment. Because the connection is persistent, it increases the likelihood of data staging and successful exfiltration before detection.

Recommendation

Detection engineering teams should implement monitoring for long-lived processes using the Cisco Network Visibility Module.

  • Deploy the provided Sigma rule (or equivalent SIEM logic) to monitor Cisco NVM flow data for osascript processes with durations exceeding 600 seconds.
  • Baseline current organizational use of osascript within administrative workflows to identify and filter out legitimate long-running scripts, reducing false positives.
  • Integrate flow data with endpoint process telemetry to provide context on the parent process that invoked osascript.
]]>mediumadvisorymacoslotlc2osascript