Fake Driver Store Fetch (T1105)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•11

Detects shell commands querying attacker-controlled domains disguised as Apple driver stores to fetch malicious macOS backdoors, specifically looking for 'coreaudiod' or 'audio-issue-fix.sh' in the URL.