MacOS Osascript Executing JavaScript Code With ObjC — Detection Rule
This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, identified by the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or perform post-exploitation activity.