macOS ClickFix Multi-Stage Process Chain: Shell→Curl→Decode→Execute→Persistence (<=28s)
Detects a rapid multi-stage infection chain on macOS, typically associated with the ClickFix campaign. The rule monitors for a sequence of process events starting from a shell, followed by a curl-based download, data decoding via base64 or openssl, execution of the decoded content via shell/python/perl, and finally persistence mechanisms using launchctl or osascript, all occurring within 28 seconds.
Cortex XDR
