The PeriodicScriptAdded analytic will detect the creation of shell scripts that will result in scheduled script execution on macOS using the periodic utility.
The periodic utility is a native tool within macOS allowing the scheduled execution of shell scripts responsible for routine tasks, like system checks, when they're stored in either the /etc/periodic/... or /usr/local/etc/periodic/... directories. The scripts contained at these locations will be executed by launchd on a monthly, weekly or daily basis and although not commonly observed, a threat actor could potentially gain persistence on a system by adding a malicious script to one of these default directories.
While adding new files to these directories does require administrative privileges, a user could inadvertently provide as part of a disguised malicious package installation. The obscurity of this utility makes it an interesting target for attackers and since periodic has long been deprecated by Apple, any new files being added to these directories is worthy of close investigation.
For more information about this type of threat see MITRE ATT&CK Tactics: Execution, Persistence, and Privilege Escalation and MITRE ATT&CK Technique: Scheduled Task/Job.