Navi The Clown Poc Binary
Detects the navi_the_clown macOS Screen Sharing pre-auth RCE PoC binary via hash/filename/command-line flag or, as a lower-confidence secondary indicator, codesign+xattr Gatekeeper-bypass staging correlated with the PoC filename or flags
YARA
