((ParentImage:\/bash Image:\/curl (CommandLine:\/sys\/log.php* OR CommandLine:\/sys\/prepod.php* OR CommandLine:\/sys\/bin\/Pods*)) CommandLine:https\:\/\/*) OR ((ParentImage:\/bash Image:\/osacompile (CommandLine:\/Users\/* CommandLine:\/Library\/Group\ Containers\/*)) OR (ParentImage:\/bash Image:\/plutil (CommandLine:LSUIElement* CommandLine:\/Users\/* CommandLine:\/Library\/Group\ Containers\/*)) OR (Image:\/zip (CommandLine:\-r* CommandLine:\/Users\/* CommandLine:\/Library\/Group\ Containers\/*)))