AppleScript
AppleScript [T1059.002]
Information
Introduction
AppleScript (T1059.002) is a sub-technique within the MITRE ATT&CK framework under the parent technique Command and Scripting Interpreter (T1059). AppleScript is a scripting language integrated into macOS, allowing users and applications to automate tasks and interact with system components and applications. Attackers exploit AppleScript to execute malicious scripts, automate actions, and control macOS systems, making it a valuable tool for adversaries aiming to establish persistence, escalate privileges, or conduct lateral movement.
Deep Dive Into Technique
AppleScript enables users and applications to automate repetitive tasks by interacting with macOS applications and system components through scripting commands. Malicious actors leverage AppleScript due to its native integration into macOS, ease of use, and ability to execute scripts without raising suspicion.
Technical details of AppleScript execution methods and mechanisms include:
Script Execution Methods:
Direct execution via the built-in
osascriptutility from the command line or shell scripts.Embedding AppleScript code within other scripting languages (e.g., Bash, Python) or compiled binaries.
Execution through Automator workflows and applications, which can encapsulate AppleScript commands.
Inclusion of scripts in malicious payloads delivered through email attachments, web downloads, or removable media.
Capabilities and Mechanisms:
Interacting with system components and applications to execute commands, manipulate files, and control user interfaces.
Automating keylogging, screen capture, clipboard capture, and other surveillance activities.
Facilitating persistence by creating scheduled tasks, login items, or Launch Agents and Daemons.
Escalating privileges through exploitation of macOS application vulnerabilities or misconfigurations triggered via AppleScript commands.
Providing lateral movement capabilities within macOS networks by automating remote command execution and file transfers.
Real-World Procedures:
Attackers frequently chain AppleScript with other macOS-native tools (e.g., Bash scripts, Automator) to evade detection.
AppleScript payloads are often obfuscated or encoded to bypass signature-based detections.
Scripts may be embedded within legitimate-looking documents or applications to trick users into execution.
When this Technique is Usually Used
Attackers use AppleScript across multiple stages of the attack lifecycle, including:
Initial Access:
Delivery through phishing emails containing malicious AppleScript payloads embedded in documents or archives.
Malicious downloads from compromised websites or software repositories.
Execution and Persistence:
Automating malware execution upon user login by configuring login items or Launch Agents.
Establishing persistent backdoors by scripting periodic callbacks to command-and-control (C2) servers.
Privilege Escalation and Defense Evasion:
Exploiting vulnerabilities in privileged macOS applications triggered through AppleScript commands.
Disabling security tools or modifying security settings via automated scripting.
Discovery and Collection:
Automating reconnaissance tasks, such as enumerating system information, user data, installed software, and network connections.
Collecting sensitive data through automated scripts for exfiltration.
Lateral Movement and Command-and-Control:
Automating remote command execution and data transfer between compromised hosts within a network.
Establishing covert communication channels to external C2 servers.
How this Technique is Usually Detected
Detection of malicious AppleScript usage typically involves multiple approaches, including behavioral analysis, script analysis, and endpoint monitoring:
Endpoint Detection and Response (EDR) Tools:
Monitoring execution of the
osascriptcommand with suspicious arguments or from unusual parent processes.Detection of unusual process chains involving AppleScript execution or Automator workflows.
Behavioral Analysis:
Identifying abnormal scripting activities, such as automated keylogging, screen captures, or clipboard monitoring.
Detecting persistent scripts configured as Launch Agents, Daemons, or login items.
File and Script Analysis:
Scanning for scripts containing suspicious commands or functions (e.g., downloading external payloads, modifying system settings).
Identifying obfuscated or encoded AppleScript content indicative of evasion attempts.
Monitoring Logs and Audit Trails:
Analyzing macOS audit logs for unusual scripting activity, especially involving sensitive system or user data access.
Reviewing user activity logs for unexpected execution of AppleScript or Automator workflows.
Indicators of Compromise (IoCs):
Suspicious AppleScript files (.scpt, .applescript) located in unusual directories.
Unusual network communications initiated by scripts executed via
osascript.Creation or modification of Launch Agents or Daemons pointing to suspicious AppleScript-based payloads.
Why it is Important to Detect This Technique
Early detection of malicious AppleScript execution is critical due to its potential impacts on system security, data confidentiality, and operational integrity:
Persistence and Stealth:
AppleScript enables attackers to establish persistent footholds that survive reboots and evade traditional antivirus detection.
Privilege Escalation and System Control:
Exploiting AppleScript can lead to unauthorized privilege escalation, allowing attackers full system control and access to sensitive data.
Data Collection and Exfiltration:
Attackers automate the collection and exfiltration of sensitive personal, financial, or intellectual property data through AppleScript-driven scripts.
Lateral Movement and Network Compromise:
AppleScript can facilitate lateral movement within macOS environments, increasing the scope and severity of compromise across organizational assets.
Operational and Reputational Damage:
Compromise of critical macOS endpoints can result in significant operational downtime, financial losses, and reputational harm.
Examples
Real-world examples of AppleScript attacks and incidents include:
OSX.Dok Malware:
Delivered via phishing emails containing malicious zip files and fake documents.
Utilized AppleScript and Automator workflows to install a persistent backdoor, intercept HTTPS traffic, and exfiltrate sensitive user data.
Impact included credential theft, unauthorized access to user communications, and potential financial fraud.
OSX.EvilEgg Malware:
Leveraged AppleScript embedded within malicious PDF documents delivered through email phishing campaigns.
Automated execution of payloads, persistence via Launch Agents, and exfiltration of user data to remote C2 servers.
Resulted in compromise of sensitive personal information and prolonged unauthorized access.
XCSSET Malware Family:
Targeted Xcode developers by injecting malicious AppleScript payloads into Xcode projects.
Automated theft of browser credentials, screenshots, and sensitive development information.
Enabled attackers to compromise developer environments, steal intellectual property, and spread malware through compromised software distribution channels.
WindTail (OSX.WindTail):
Distributed through phishing emails targeting macOS users, particularly in government and business sectors.
Utilized AppleScript to automate installation of persistent backdoors, reconnaissance, and data exfiltration.
Impact involved espionage, theft of sensitive organizational data, and prolonged unauthorized access to targeted systems.
These examples demonstrate the diverse ways attackers leverage AppleScript to conduct sophisticated, impactful attacks against macOS environments.
Last updated
Was this helpful?