macOS detection: Osascript Long Lived Connection To Remote Host

detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml

@@ -0,0 +1,89 @@
+name: MacOS Osascript Long Lived Connection to Remote Host
+id: 6bc88a9d-f7de-4257-b526-acf15bc5a517
+version: 1
+creation_date: '2026-09-18'
+modification_date: '2026-09-18'
+author: Radka Viskova, Splunk
+status: production
+type: Anomaly
+description: Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes. Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.
+data_source:
+    - Cisco Network Visibility Module Flow Data
+search: |-
+    `cisco_network_visibility_module_flowdata`
+    | eval ParentImage=lower(ppn),
+           ParentPath=lower(pppath),
+           StartTimeAsUnix=tonumber(fsms),
+           EndTimeAsUnix=tonumber(fems),
+           duration_minutes=round((EndTimeAsUnix-StartTimeAsUnix)/60000,2)
+    | where (
+            ParentImage="osascript"
+            OR like(ParentPath,"%/osascript")
+        )
+        AND isnotnull(StartTimeAsUnix)
+        AND isnotnull(EndTimeAsUnix)
+        AND EndTimeAsUnix > StartTimeAsUnix + 600000
+    | stats count
+        min(StartTimeAsUnix) as firstTime
+        max(EndTimeAsUnix) as lastTime
+        max(duration_minutes) as duration_minutes
+        values(ppn) as parent_process_name
+        values(pppath) as parent_process_path
+        values(pparg) as parent_process_arguments
+        values(ppath) as process_path
+        values(dh) as dest_hostname
+        values(dp) as dest_port
+        by src udid dest dh dp ppn pppath ppath
+    | eval firstTime=firstTime/1000,
+           lastTime=lastTime/1000
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | table firstTime lastTime src udid dest dest_hostname dest_port duration_minutes parent_process_name parent_process_path parent_process_arguments process_path
+    | `macos_osascript_long_lived_connection_to_remote_host_filter`
+how_to_implement: |-
+    This detection requires Cisco Network Visibility Module flow data ingested through the Cisco Endpoint Security Analytics Add-on for Splunk. The `cisco_network_visibility_module_flowdata` macro must be configured for the local index, source, and sourcetype. The search uses the raw NVM fields `fsms` and `fems`, which may also be aliased as `flow_start_msec` and `flow_end_msec`.
+known_false_positives: |-
+    Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations.
+references:
+    - https://attack.mitre.org/tactics/TA0002/
+    - https://attack.mitre.org/tactics/TA0011/
+    - https://attack.mitre.org/techniques/T1059/002/
+    - https://attack.mitre.org/techniques/T1059/004/
+    - https://www.loobins.io/binaries/osascript/
+drilldown_searches:
+    - name: View detection results for "$src$" and "$dest$"
+      search: '%original_detection_search% | search src="$src$" dest="$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for "$src$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: src
+          type: system
+          score: 20
+          message: The macOS host $src$ used $parent_process_name$ to initiate a network connection to $dest_hostname$ lasting $duration_minutes$ minutes.
+threat_objects:
+    - field: parent_process_name
+      type: process_name
+analytic_story:
+    - Cisco Network Visibility Module Analytics
+asset_type: Endpoint
+mitre_attack_id:
+    - T1059.002
+    - T1059.004
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/21dc8cc7dcde97dc412092c31d3a6500832f1f0e/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log
+          source: not_applicable
+          sourcetype: cisco:nvm:flowdata:v2
+      test_type: unit