This analytic detects macOS osascript executing JavaScript for Automation (JXA) code, identified by the -l JavaScript interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or perform post-exploitation activity. The detection uses an osquery-backed endpoint data model to identify when the osascript process runs with command lines that include -l (JavaScript) and indicators of Objective-C bridging. Fields such as the process, destination, parent process, and user are surfaced to enable correlation with accounts and workflows. The analytic highlights an Osascript invocation that supplies JavaScript code and interacts with Objective-C APIs, which can be leveraged to automate app interactions, access system resources, or execute commands without leaving obvious traces in less-trusted activity traces. It maps to MITRE ATT&CK techniques T1059.002 (JavaScript) and T1059.007 (AppleScript/ObjC bridging) and is contextualized under MacOS Post-Exploitation. The rule is implemented via a Splunk OSQuery integration, requiring the TA-OSQuery across indexers and forwarders to populate the data models. A legitimate false positive could be administrators or Mac automation workflows that legitimately invoke osascript with JavaScript for management tasks. The detection supports rapid investigation by matching -l JavaScript and ObjC references in the osascript invocation and by correlating with user, host, and parent process information.