← Back to SOC feed Coverage →

launch-questd-w-osascript

kql MEDIUM Azure-Sentinel
DeviceFileEventsDeviceProcessEvents
huntingmicrosoftofficialransomware
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-20T23:00:01Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the detection of launch-questd-w-osascript indicates an adversary is attempting to execute malicious scripts or payloads through a compromised macOS service, potentially leading to ransomware deployment. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage macOS ransomware attacks before significant data encryption or exfiltration occurs.

KQL Query

union DeviceFileEvents, DeviceProcessEvents  
| where Timestamp >= ago(7d)  
| where ProcessCommandLine has "osascript -e do shell script \"launchctl load" and  
ProcessCommandLine contains "questd"

Analytic Rule Definition

id: 4e186f05-8cff-4afa-a0c8-4f0f0e7aeb82
name: launch-questd-w-osascript
description: |
  This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
  As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
  The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
  Other queries related to EvilQuest ransomware can be found under the See also section below.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
  - DeviceProcessEvents
tactics:
- Execution
- Impact
query: |
  union DeviceFileEvents, DeviceProcessEvents  
  | where Timestamp >= ago(7d)  
  | where ProcessCommandLine has "osascript -e do shell script \"launchctl load" and  
  ProcessCommandLine contains "questd"

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled
DeviceProcessEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Execution/launch-questd-w-osascript.yaml