Silent Sparkle Update Execution (FlutterShell)
Detects suspicious execution of the 'open' command targeting the Sparkle framework's installation cache directory on macOS. This activity could indicate the use of a backdoor like FlutterShell attempting to silently update or execute malicious code via a legitimate update mechanism.
Microsoft Sentinel (KQL)
