ClickFix macOS osascript Execution from Network

Daniel Jeremiah@daniyyell

•updated Feb 13, 2026•1•0•44

This rule detects the execution of 'osascript' on macOS when its parent command line contains 'curl'. This pattern is indicative of a stager piping a curl response directly to osascript, often without writing a script to disk, as described in the ClickFix and MacSync/SHub delivery patterns by Datadog.