Werkbit notarized dropper execution on macOS

Duo Tech@duotech

•updated Jul 14, 2026•0•0•1

Detects the execution of processes where the image name or path contains the string 'werkbit'. This is often associated with the execution of potentially malicious or unauthorized tools.