Suspicious Installer Package Child Process

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters