Fix false positives for OpenCode to some osascript related rules#6027
Merged
Conversation
Contributor
|
Welcome 👋 It looks like this is your first pull request on the Sigma rules repository! Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval. Thanks again, and welcome to the Sigma community! 😃 |
github-actions
Bot
added
Review Needed
Rename rule to reflect that clipboard access via osascript is not inherently data collection, soften description and false positives accordingly, reduce level from high to medium, and tighten the OpenCode filter to use more specific command line conditions.
swachchhanda000
approved these changes
May 22, 2026
frack113
approved these changes
May 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of the Pull Request
This PR updates the logic for two detections matching suspicious usage of OSAScript on MacOS. The rules are updated to not generate false positives for
Opencode. Opencode is a popular tool for running AI agents, used by many developers worldwide. Embedding the filter into the rules should improve overall quality for consumers.Changelog
fix: MacOS Scripting Interpreter AppleScript - filter opencode
fix: Clipboard Access Via OSAScript - filter opencode
Example Log Event
The following sample log contains the relevant fields. I had to remove most of the original event.
{ "CommandLine": "osascript -e set the clipboard to <REDACTED>", "Image": "/usr/bin/osascript", "ParentImage": "opencode" }Fixed Issues
SigmaHQ Rule Creation Conventions