XCSSET v40: Malicious .zshrc Base64/C2 Append & Dock Persistence via Temp Path
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Microsoft Sentinel (KQL)
