Detects macOS AppleScript usage that executes shell commands or compiles AppleScript containing shell commands. The rule flags osascript invocations that run shell commands via AppleScript's do shell script, and identifies osacompile invocations referencing do shell script. Data is sourced from osquery results (Endpoint.Processes) and correlates on process name (osascript or osacompile) with commandline content such as shell, script, or do shell script patterns. The analytic maps activity_type to: (1) AppleScript Shell Command Execution for osascript, and (2) AppleScript Compilation or Staging for osacompile. It surfaces contextual fields like destination, user, parent process details, and process metadata to facilitate investigation. Note: matches involving osacompile should be interpreted as compilation or staging of AppleScript (i.e., preparing scripts for later execution) rather than direct shell execution. Legitimate administrative scripts or automation tools using AppleScript may generate false positives and should be considered in tuning and whitelisting.