XCSSET Loader /tmp/r and /tmp/p.app Created Then Deleted Within Short Window
Detects XCSSET's loader binary staged to /tmp/r and an AppleScript wrapper compiled on the fly at /tmp/p.app, both created and deleted within a short window to erase forensic footprint.
Microsoft Sentinel (KQL)
