Meow RAT Fileless AppleScript Execution via curl Pipe to osascript
Detects potential fileless execution of Meow RAT by monitoring process command lines for 'curl' fetching an AppleScript payload and piping it to 'osascript'. It also looks for specific Meow RAT indicators like C2 domains, payload names, and build hashes.
Microsoft Sentinel (KQL)
