MacOS Osascript Displaying Suspicious User Prompt — Detection Rule
The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content. Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information. This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.