AN0994: Analytic 0994
Monitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written.
Analyst context for executives and security teams
This analytic is a macOS-focused detection idea for suspicious activity immediately following browser use: Safari or another browser spawning processes that load scripts or executables, or files written to user cache/download locations and executed shortly afterward. For leaders, the value is validating whether endpoint and log coverage can connect browser activity, file creation, and execution timing during an investigation.
Executive priority
Prioritize this as an endpoint visibility and incident readiness check for macOS environments. It helps answer whether the organization can produce evidence around browser-originated execution chains, which can matter for containment decisions, audit defensibility, and determining whether suspicious downloads or cached content became active code. Because ATT&CK provides no tactic mapping or relationship context here, treat it as a coverage validation item rather than a standalone risk conclusion.
Technical view
SOC and detection teams should validate collection of macOS unified logs and endpoint process/file telemetry sufficient to correlate parent browser processes, child process execution, script or executable loading, file writes in ~/Library/Caches and ~/Downloads, and short write-to-execute timing. Tune for legitimate browser helper processes, software installers, user-initiated downloads, and enterprise management workflows before escalating as suspicious.
Likely telemetry
- macOS unified logs
- Endpoint process creation events with parent-child process context
- File creation/write events in ~/Library/Caches
- File creation/write events in ~/Downloads
- Execution events for scripts or executables
Detection direction
- Confirm Safari and other browser process trees are visible in endpoint telemetry.
- Correlate browser-spawned processes with immediate script or executable loading.
- Detect files written to ~/Library/Caches or ~/Downloads that execute shortly after creation or modification.
- Baseline common legitimate macOS browser, installer, updater, and user download behavior to reduce false positives.
- Validate whether unified log retention and endpoint retention are long enough to support incident response timelines.
Mitigation priorities
- Ensure macOS endpoint logging captures process, file, and execution context needed for this analytic.
- Review controls governing execution from user download and cache locations.
- Harden and monitor browser-to-child-process behavior where feasible within existing endpoint policy.
- Document expected business workflows that execute downloaded files so analysts can distinguish normal activity from suspicious chains.
- Use findings to improve incident response playbooks for browser-originated execution investigations.
Analyst notes and limits
The supplied ATT&CK object is a detection analytic, not a technique description. It is limited to macOS and describes monitoring logic, but provides no official detection section, tactics, relationships, adversary context, or mitigation mappings. Local baselines are essential because browser downloads and installer execution can be normal user behavior.
No active exploitation, attribution, impact, tactic, or relationship context is supplied. Detection feasibility depends on local macOS log configuration, endpoint telemetry quality, retention, and the ability to correlate file-write and execution timing.
Analytic 0994
Monitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | c278cb85bc17… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0994Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.