XCSSET v40 - Xcode build phase dropping/launching a payload
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Microsoft Sentinel (KQL)
