Sigma rule: Clipboard Access Via OSAScript

Rule

Title

Clipboard Access Via OSAScript

Status

test

Level

medium

Author

Sohan G (D4rkCiph3r)

Date

2023-01-31

Modified

2026-05-22

File

rules/macos/process_creation/proc_creation_macos_clipboard_access_via_osascript.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts

Log source

product

macos

category

process_creation

Detection

selection:
    Image|endswith: '/osascript'
    CommandLine|contains|all:
        - ' -e '
        - 'clipboard'
filter_optional_opencode:
    # OpenCode uses osascript to handle copying text from the TUI on MacOS devices. See https://github.com/anomalyco/opencode/blob/ca723f1cbc6fc4244ae57e61e9de8c4e37380ed4/packages/opencode/src/cli/cmd/tui/util/clipboard.ts#L65 for reference.
    ParentImage|endswith: 'opencode'
    CommandLine|contains|all:
        - 'osascript'
        - ' -e '
        - 'set imageData to the clipboard'
        - 'set fileRef'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate clipboard utilities and automation scripts that read or write clipboard content
• Developer tools and IDEs that use osascript for clipboard integration

Tags

• attack.collection
• attack.execution
• attack.t1115
• attack.t1059.002

MITRE ATT&CK ids this rule names

• T1059.002
• T1115

Related rules

• 1bc2e6c5-0885-472b-bed6-be5ea8eace55 (derived)

References

• https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_clipboard_access_via_osascript.yml