AN0183: Analytic 0183
Use of nohup, disown, or AppleScript constructs to suppress process interrupts. Defender perspective: commands containing nohup or hidden background tasks (`osascript` with persistent execution) correlated with processes surviving user logouts.
Analyst context for executives and security teams
This analytic focuses on macOS processes that are intentionally made to keep running after a user session ends, such as through nohup, disown, or AppleScript-driven background execution. For security leaders, the practical issue is persistence and loss of visibility: activity that survives logout can continue outside normal user workflows and may be missed if monitoring is centered only on interactive sessions.
Executive priority
Prioritize this as a macOS endpoint visibility and incident readiness question. Leaders should ask whether SOC and IR teams can prove which processes continue after logout, who launched them, and whether they were expected administration or suspicious background activity. The value is strongest for organizations with managed macOS fleets, compliance needs around endpoint auditability, or operational reliance on user workstations.
Technical view
For SOC and detection teams, validate collection and correlation for macOS command execution involving nohup, disown, and osascript patterns associated with hidden or persistent background execution. The key analytic concept is not just the command string, but correlation with process lifetime across user logout events. Because ATT&CK provides no separate detection logic and no relationship context here, teams should treat AN0183 as a detection design prompt rather than a complete rule.
Likely telemetry
- macOS process creation events with command-line arguments
- Parent-child process relationships for shells and osascript
- User logon and logout/session termination events
- Process lifetime or endpoint telemetry showing processes surviving logout
- Endpoint security or EDR records for background tasks and script execution
Detection direction
- Confirm that command-line telemetry captures nohup, disown, and osascript invocations on macOS endpoints.
- Correlate process start time, launching user, parent process, and whether the process remains active after logout.
- Tune for legitimate administrative scripts, developer workflows, and approved background jobs to reduce false positives.
- Review visibility gaps where endpoint logging stops at logout or lacks process lifetime tracking.
- Use this analytic with local baselines because ATT&CK supplies no tactic mapping, relationships, or complete detection implementation.
Mitigation priorities
- Establish approved-use expectations for persistent macOS background execution and administrative scripting.
- Ensure endpoint logging and managed detection coverage persist beyond interactive user sessions.
- Restrict or monitor script execution paths where appropriate through existing endpoint and device management controls.
- Document expected long-running processes so SOC triage can distinguish normal operations from suspicious persistence-like behavior.
- Include this scenario in macOS incident response playbooks and audit evidence for endpoint monitoring coverage.
Analyst notes and limits
AN0183 is a macOS detection analytic describing suppression of process interrupts and persistence of processes after logout using nohup, disown, or AppleScript constructs. No tactics, relationships, aliases, labels, or formal detection text were supplied, so the Glexia take emphasizes validation of telemetry and correlation design rather than asserting a specific ATT&CK technique outcome.
The supplied object is sparse: official detection is not provided, tactics are not specified, and no relationships are available. Environment-specific baselines are required to determine whether observed use is benign administration, development activity, or suspicious behavior.
Analytic 0183
Use of nohup, disown, or AppleScript constructs to suppress process interrupts. Defender perspective: commands containing nohup or hidden background tasks (`osascript` with persistent execution) correlated with processes surviving user logouts.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 2f6c7dc7e6f4… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0183Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.