locate-shlayer-payload-decryption-activity

This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push. Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads. The following query locates activity associated with the Shlayer payload decrypter. Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/