Cisco NVM - Osascript Network Connection for a Long Duration — Detection Rule
This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.