MacOS Osascript Executing Interactive Shell — Detection Rule
This analytic detects the macOS osascript utility being used with an interactive Bash invocation, identified by the presence of "bash -i" in the command line. Adversaries may abuse osascript and AppleScript's shell execution capabilities to launch interactive shells, establish remote access, or execute post-exploitation commands.