macOS ClickFix loader downloads second-stage payload via curl to /tmp
Detects the use of common command-line utilities (curl or wget) to download files to a temporary directory (/tmp/helper), initiated from within an interactive shell session (sh, zsh, bash). This pattern is commonly observed during the initial stages of post-exploitation, where threat actors download malicious scripts or tools to a staging directory before execution.
Microsoft Sentinel (KQL)
