Osascriptpassword
Query
DeviceProcessEvents
| where ProcessCommandLine has_all ("osascript", "dialog", "password")
References:About this query
Tags:
Query:
Explanation
The query is looking for DeviceProcessEvents where the ProcessCommandLine contains all three keywords: "osascript", "dialog", and "password".
Details
Ali Hussein
Released: October 28, 2023
Tables
DeviceProcessEvents
Keywords
DeviceProcessEventsProcessCommandLineosascriptdialogpassword
Operators
|wherehas_all