XCSSET: osascript -e Combined with curl Subprocess or Parent for Fileless AppleScript Execution

Duo Tech@duotech

•updated Jul 31, 2026•5•0•5

Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.