kevmap

TechniquesT1119 › AN0533

AN0533 Analytic 0533

macOS · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Use of pbpaste, AppleScript, or third-party automation frameworks (e.g., Automator) to collect clipboard or file content in bursts. Observable via unified logs.</p>
Detects
T1119 Automated Collection
Part of
DET0186 Automated File and API Collection Detection Across Platforms

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
macos:unifiedloglogMessage contains pbpaste or osascriptDC0032 Process Creation
macos:unifiedlogsubsystem=launchservicesDC0029 Script Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
AutomationToolDetectable script interpreters or clipboard tools (pbpaste, osascript).
ClipboardCheckRateThreshold for how often clipboard access occurs within a given time window.

KEV CVEs whose mapped technique this analytic detects

CVEVendor / productState
CVE-2010-2861Adobe ColdFusionMapped