This anomaly detects macOS osascript usage that runs AppleScript commands to display a dialog or alert containing content that could be deceptive or related to credentials. Adversaries may use osascript to present fake system messages or credential prompts to trick users into divulging sensitive information. The rule focuses on command-line content from osascript and should be reviewed with the parent process, executing user, script content, signer, and surrounding endpoint activity. It maps to MITRE techniques for scripting (AppleScript) and input/credential-related prompts, and it relies on osquery data populated via the TA-OSquery deployment. Legitimate administrative, MDM, or automation scripts may also display dialogs; review context before flagging as malicious.