Signal Desktop Cache Access by Suspicious Process
Detects suspicious processes attempting to access the Signal Desktop attachments directory. This behavior indicates potential data collection by post-compromise tooling, such as the InboxSetupPro second-stage tool observed in Nimbus RAT campaigns.
Microsoft Sentinel (KQL)
