T1059.002 — AppleScript

Tactic: Execution · Platforms: macOS

Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents. These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (1)

T1059.002 Command and Scripting Interpreter: AppleScript

title: "T1059.002 Command and Scripting Interpreter: AppleScript"
id: 76ad9cad-e4c4-4966-abff-d6560398fd6a
description: 'Detection of AppleScript-Based Execution on macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptInvocationParent, TimeWindow, AppleEventActionType, TargetApplicationSet, ExecutionPathRegex.'
references:
  - https://attack.mitre.org/techniques/T1059/002
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.execution
  - attack.t1059.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains|all:
      - '-e'
      - 'do shell script'
  condition: selection

falsepositives:
  - Legitimate automation workflows (Automator, internal tools) that call do shell script from AppleScript for administrative tasks.

level: high

Related sub-techniques

Explore