All Detections

macOS RAT com.apple.act.mond Process Injection via ad-hoc codesign

Effy Elden@ineffyble
updated Mar 31, 2026066

Detects codesign --sign - used to ad-hoc sign a payload dropped to /private/tmp by a non-system process

Sigma