Suspicious ClickFix Terminal Command Execution
Detects the execution of commands indicative of a user pasting a malicious script into the Terminal, often associated with ClickFix or fake CAPTCHA social engineering attacks. This typically involves using tools like `curl` to download and pipe payloads directly to a shell, or the use of `pbpaste` to execute clipboard contents.
Sigma
