Osascriptpassword
Query
DeviceProcessEvents
| where ProcessCommandLine has_all ("osascript", "dialog", "password")
References:About this query
Tags:
Query:
Explanation
The query is looking for DeviceProcessEvents where the ProcessCommandLine contains all three keywords: "osascript", "dialog", and "password".