Trojanized Terraform provider spawning sh -c safari_updater or contacting hashic
Detects suspicious behavior involving Terraform provider processes launching shells running update scripts, communicating with malicious lookalike domains or endpoints, or dropping specific files such as safari_updater or session.lock.
Microsoft Sentinel (KQL)
