Technical summary: This detection flags when macOS’s osascript is used to launch an interactive shell via Bash, identified by command lines containing both 'bash' and '-i'. The analytic uses osquery data (Endpoint.Processes) to surface events where the process_name is 'osascript' and the command line includes an interactive Bash invocation. This pattern is commonly associated with adversaries abusing osascript/AppleScript to spawn remote-access shells or to execute post-exploitation commands. The rule collects contextual fields (action, destination, parent process details, process identifiers, user, and command information) to enable thorough investigations and facilitate drill-downs. It maps to MITRE ATT&CK techniques T1059.002 (AppleScript) and T1059.004 (Unix Shell). Known false positives include legitimate administrative scripts, MDM workflows, software deployment tools, developer automation, or support utilities that legitimately invoke osascript in interactive mode. Implementation guidance notes that TA-OSquery must be deployed across indexers and universal forwarders to populate osquery data models, as described in the references. The detection is categorized as an Endpoint/macOS post-exploitation style alert.