Record · corpus.blog/posts/01a087be-8719-7396-a325-4f824ab08b55

AEMonitor: Monitoring Apple Events for Malware Analysis and Detection

pberba.github.io · published 21 February 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at pberba.github.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 31
Words captured: 3,023

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/pberba/AEMonitor

github.com

Decompiling run-only AppleScripts Read at the source ↗

pberba.github.io

https://github.com/jamf/jamfprotect/blob/34e1c6c6e1c96d79ab0e760d2cb0f6cea7f8aa38/custom_analytic_detections/applescript_dialog_activity.yaml

github.com

https://github.com/Pent/bincapz/blob/cb4e8f4bf3ac137a8355653209be2f156ae6de0b/rules/ref/program/osascript.yara

github.com

https://github.com/elastic/detection-rules/blob/cf6472005a64805453f868248895884c43725b6f/rules/macos/credential_access_promt_for_pwd_via_osascript.toml

github.com

https://redcanary.com/threat-detection-report/techniques/applescript/

redcanary.com

https://github.com/elastic/detection-rules/blob/cf6472005a64805453f868248895884c43725b6f/rules/macos/persistence_creation_hidden_login_item_osascript.toml

github.com

https://github.com/elastic/protections-artifacts/blob/473c8536449c12f4e6bf1dc7de4fbded217592a5/behavior/rules/macos/execution_volume_muted_via_osascript.toml

github.com

https://github.com/SigmaHQ/sigma/blob/dc3880459dee068819025a826f9053a4f303daec/rules/macos/process_creation/proc_creation_macos_clipboard_data_via_osascript.yml

github.com

https://github.com/jamf/jamfprotect/blob/34e1c6c6e1c96d79ab0e760d2cb0f6cea7f8aa38/custom_analytic_detections/applescript_gather_clipboard.yaml

github.com

The Mac Malware of 2025 Read at the source ↗

objective-see.org

https://www.virustotal.com/gui/file/b8f713be3f9cce6d03fb60a233c4e08181015a5a8c8486b83683589d70d4c213/

virustotal.com

https://developer.apple.com/documentation/endpointsecurity/es_event_type_notify_btm_launch_item_add

developer.apple.com

https://github.com/MythicAgents/apfell/tree/2323cb3b45f9f91adb3e71b32e88fb33e48d14ff

github.com

https://github.com/MythicAgents/apfell/blob/2323cb3b45f9f91adb3e71b32e88fb33e48d14ff/documentation-payload/apfell/commands/terminals_send.md

github.com

https://applescriptlibrary.wordpress.com/wp-content/uploads/2013/11/apple-events-programming-guide.pdf

applescriptlibrary.wordpress.com

https://developer.apple.com/library/archive/releasenotes/AppleScript/ASTerminology_AppleEventCodes/TermsAndCodes.html

developer.apple.com

https://github.com/JXA-userland/JXA/blob/4ad161a3ee56eb7e3e406ad20e9a19f0343132da/packages/%40jxa/types/tools/sdefs/StandardAdditions.sdef

github.com

https://developer.apple.com/library/archive/documentation/mac/pdf/Interapplication_Communication/Specify_And_Find_AE_Objs.pdf

developer.apple.com

https://www.jamf.com/blog/unified-logs-how-to-enable-private-data/

jamf.com

https://www.youtube.com/watch?v=V6VnQ-h4K-o

youtube.com

https://github.com/PhorionTech/Kronos

github.com

https://objectivebythesea.org/v6/talks/OBTS_v6_lRoberts_cHall.pdf

objectivebythesea.org

https://stackoverflow.com/questions/53621146/get-apple-events-from-applescript

stackoverflow.com

https://securitylabs.datadoghq.com/articles/tech-impersonators-clickfix-and-macos-infostealers/

securitylabs.datadoghq.com

https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis

huntress.com

MacOS Infection Vector: Using AppleScripts to bypass Gatekeeper Read at the source ↗

pberba.github.io

https://github.com/Brandon7CC/mac-monitor/pull/79

github.com

https://censys.com/blog/odyssey-stealer-macos-crypto-stealing-operation

censys.com

https://x.com/_calumhall

x.com

https://x.com/sysop_host

x.com