Ad-hoc Codesign of Hidden /tmp Binary
Detects use of codesign to apply an ad-hoc signature to a hidden binary in /tmp, allowing it to execute on modern macOS without a valid developer certificate, typically performed immediately after quarantine removal as part of a Gatekeeper bypass chain.
CQL
