AppleScript Susp Payload Download
Detects 'osascript' (AppleScript) executing 'curl' to download a second-stage payload. This updated rule is tuned to detect specific indicators from a known campaign, such as the use of silent/insecure flags, downloads to hidden script files (e.g., .ex.scpt), or connections to known malicious domains.
Sigma
