macOS ClickFix curl Pipe to zsh/sh
This rule detects suspicious process creation activity on macOS systems where `curl` output is piped directly into a shell, specifically `zsh` or `sh`. This technique is often used by attackers to execute malicious scripts directly from a remote source without writing them to disk. The rule looks for `zsh` processes with command lines containing `curl` and a pipe character, or `curl` processes with a pipe character in their command line. This behavior is associated with campaigns like Datadog Tech Impersonators (ClickFix).
Sigma
