All Detections

Mac ClickFix - Tmp Helper Staging

avatar
Ibrahim Saud@tektrix
updated Jun 21, 2026003

Identifies the first-stage script downloading the Mach-O binary payload directly into /tmp/helper or /tmp/update using 'curl'.

Microsoft Sentinel (KQL)