317. Adversaries Use AppleScript Files More and More Often
Hello everyone! We don't talk a lot about macOS attacks, so lets change it, and look at some examples of Masquerading: Double File Extension (T1036.007) . Researchers note that adversaries use .scpt AppleScript files more and more often in recent months. Examples include both advanced threats like BlueNoroff and commodity malware, for example, Odissey Stealer and MacSync Stealer. For example, adversaries commonly create fake .docx and .pptx files: Stable1 Investment Proposal (Draft) (EN).pptx.scpt , AM Management _Strategic OTC Collaboration Proposal.docx.scpt . This provides us some simple detection opportunities: event_type: "processcreatemac" AND cmdline: (*pptx.scpt OR *.docx.scpt) See you tomorrow!