New blog post: Living Inside the Shell: zsh Modules on macOS zsh is much more than a command interpreter. Through its module system, the shell can perform operations that defenders often associate with separate binaries: establish TCP connections, manipulate files, access extended attributes, and more. That creates an interesting detection problem. If your logic mainly looks for tools such as curl, wget, nc, xattr, or rm, or relies heavily on child-process creation, you may only detect one implementation of the behavior. In the post, I look at zsh/net/tcp, zsh/mapfile, and zsh/attr, including a second-stage script executed directly from a socket without first being written to disk. From a DFIR perspective, the interesting part is what still remains visible. Using Apple Endpoint Security telemetry, I show that avoiding the usual utility does not necessarily hide the underlying action.