MacOS Osascript Displaying Suspicious User Prompt

name: MacOS Osascript Displaying Suspicious User Prompt
id: d565ae18-7db6-460c-a2eb-a7109f18bc5e
version: 1
creation_date: '2026-08-03'
modification_date: '2026-08-31'
author: Radka Viskova, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content.
    Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information.
    This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name="osascript"
    Processes.process IN (
        "*display alert*",
        "*display dialog*"
    )
    Processes.process IN (
        "*access System*",
        "*authentication*",
        "*credentials*",
        "*critical update*",
        "*needs your attention*",
        "*password*",
        "*security update*",
        "*system error*",
        "*verify*",
        "*with hidden answer*"
    )

    BY Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_osascript_displaying_suspicious_user_prompt_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity.
references:
    - https://attack.mitre.org/tactics/TA0002/
    - https://attack.mitre.org/tactics/TA0006/
    - https://attack.mitre.org/techniques/T1056/002/
    - https://attack.mitre.org/techniques/T1059/002/
    - https://www.loobins.io/binaries/osascript/
    - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1
    - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/
    - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
drilldown_searches:
    - name: View the detection results for - "$user$" and "$dest$"
      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The osascript utility executed a command containing dialog-related and potentially deceptive content on endpoint [$dest$] with the Command Line [$process$].
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1059.002
    - T1056.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log
          source: osquery
          sourcetype: osquery:results
      test_type: unit