Payload Decoded and Decrypted via Built-in Utilities (234dc5df-40b5-49d1-bf53-0d44ce778eca)
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.