Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1059.002sub-technique of T1059 Command and Scripting Interpreter

AppleScript

macOSnothing on this site yetT1059.002 on attack.mitre.org

Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents. These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Detection of AppleScript-Based Execution on macOS

  • Detects AppleScript execution via 'osascript', NSAppleScript/OSAScript APIs, and abnormal application control events across user sessions. Focuses on causal chains such as osascript spawning child processes, script-induced keystrokes, or API-backed dialog spoofing.

what reduces it

  • M1038 Execution Prevention. Use application control where appropriate.
  • M1045 Code Signing. Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing. This subjects AppleScript code to the same scrutiny as other.app files passing through Gatekeeper.

the rest of T1059

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.