PKG postinstall launching staged preinstall script via open/nohup
Detects the use of 'open' or 'nohup' to execute files located within '/Library/Application Support/' specifically containing 'Extra/preinstall' in the command line. This pattern is often indicative of unauthorized or suspicious execution of installation scripts, potentially used to maintain persistence or execute malicious payloads from non-standard locations on macOS systems.
Microsoft Sentinel (KQL)
