CrashStealer: curl/base64 shell chain fetching payload from raw.githubusercontent.com
Detects the use of shell interpreters (sh, bash, zsh) to download content from GitHub using curl (specifically using the -s silent flag) and subsequent base64 decoding of potentially obfuscated payloads using the base64 command with the -D flag.
Cortex XDR
