Meow RAT ClickFix Fileless zsh Loader via gzip+base64 Heredoc Eval
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless Zsh loaders. This rule identifies the execution of Zsh, Bash, or Sh processes that combine 'eval', 'base64', and 'gzip' with 'curl' or 'osascript' in their command line, often including redirection to /dev/null. This combination indicates an attempt to fetch and execute a gzipped and base64-encoded payload directly in memory.
Microsoft Sentinel (KQL)
