macOS Signed Application Spawning Script Interpreter
Description: Detects the execution of a signed macOS application that subsequently spawns a script interpreter like osascript, sh, or bash. This behavior is uncommon for many legitimate GUI applications but is a known TTP for macOS malware like Odyssey Stealer, which uses signed droppers to execute malicious scripts for credential theft, persistence, and payload delivery.
Microsoft Sentinel (KQL)
