Living off the OrchardApple Script
A curated library of AppleScript and JXA atomic tests mapped to the MITRE ATT&CK® framework — helping security teams test and validate macOS defenses.
2
Script Types
AppleScript & JXA
34
ATT&CK Techniques
MITRE ATT&CK mapped
71
Total Scripts
Atomic tests
Script Database
71 scripts across 34 ATT&CK techniques
| Elevation | TCC | |||
|---|---|---|---|---|
T1005 | Copy Apple Notes database | AppleScript | ||
T1010 | Find all running applications which currently have a window | AppleScript | ||
T1010 | Get the frontmost application (using AppKit) | AppleScript | ||
T1010 | Get the frontmost application (using System Events) | AppleScript | ||
T1016.001 | Test Internet connection | AppleScript | ||
T1018 | Read local hosts file | AppleScript | ||
T1021.002 | Mount SMB share via AppleScript | AppleScript | ||
T1021.005 | Enumerate remote volumes via RAE | AppleScript | ||
T1021.005 | Remote execution via Terminal proxy via RAE | AppleScript | ||
T1021.005 | Remote Finder comment staging via RAE | AppleScript |