This anomaly detects macOS Osascript (AppleScript) activity that initiates a network connection lasting longer than 600 seconds (10 minutes) using Cisco Network Visibility Module flow data. The search triggers when either the parent_process_name or process_name equals osascript and computes duration as fes - fss, selecting events where duration > 600. The rule aggregates results by source, destination, transport, and process metadata, recording first/last seen times and contextual fields such as destination hostname, port, HTTP method, and process hashes. The intent is to surface potential misuse of Osascript for long-lived command-and-control or remote connections. Known false positives include legitimate administrative scripting, automation, software deployment, or maintenance tasks that legitimately run long. The rule maps to MITRE techniques T1059.002 (OS scripting) and T1071.001 (Web Protocols). It leverages Cisco NVM flow data within Splunk (CES Analytics ecosystem) and includes detailed drilldown and intermediate findings to assist investigations. Overall, it targets endpoint protection for macOS by identifying unusual, sustained Osascript-driven network activity that could indicate post-exploitation or remote access attempts.