How many Living-off-the-Land Binaries abuse T1059.002?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute AppleScript (T1059.002).

How can detection engineers monitor for T1059.002?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1059.002Tactic: ExecutionOfficial MITRE ATT&CK Page

T1059.002: AppleScript

Adversaries may abuse AppleScript commands or osascript to execute malicious code, harvest credentials via fake prompts, or interact with macOS services.

Total Capable Binaries: 1

•

Windows: 0

•

Linux: 0

•

macOS: 1

Living-off-the-Land Matrix for T1059.002

Across 1 verified binaries

macOS2 payloads

osascript

Osascript executes Open Scripting Architecture (OSA) scripts such as AppleScript and JavaScript for Automation (JXA). Widely used in macOS malware to display convincing phishing dialogs, harvest credentials, control System Events, and execute shell commands.

Sample Attack Vector:

osascript -e 'display dialog "System Update requires your password to continue:" default answer "" with hidden answer with icon caution'

Inspect osascript & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers