macOS Suspicious Curl Script Execution

Tim Peck@timpeck

•updated Sep 4, 2025•3•1•109

Detects the use of 'curl' on macOS with specific flags (-f, -s, -L) commonly used to download and execute scripts from the internet. This pattern is a known technique used by malware like AMOS Stealer to gain initial access by tricking users into running malicious commands in the Terminal.