macOS Data Exfiltration via Curl POST
Detects the use of the curl command-line utility to perform an HTTP POST request uploading a .zip archive. This behavior is characteristic of the exfiltration phase used by macOS malware, such as Miolab Stealer, to silently transfer staged sensitive files and system profiles to a remote command-and-control server.
Sigma
