macOS Data Staging via Native Ditto Archiving
Detects the use of the macOS native ditto command to compress files and directories into a .zip archive. This technique is frequently used by macOS stealers, such as Miolab and AMOS, to quietly stage collected sensitive documents (PDFs, TXTs, RTFs) and profile data before exfiltrating it to a remote command-and-control server, avoiding the need to drop noisy third-party archiving tools.
Sigma
