Malicious preinstall script staged under Library/Application Support Extra path
This rule detects the presence or execution of a 'preinstall' script located within a path structure typical of macOS installer packages containing an 'Extra' directory. Such scripts are often used during software installation to perform arbitrary tasks with elevated privileges and may be abused by adversaries for persistence or malicious payload delivery.
Microsoft Sentinel (KQL)
