macOS Info.plist Modified to Bypass Detection
This rule detects attempts to modify the Info.plist file on macOS systems to include 'LSUIElement' with a value of '<true/>'. This modification can be used by malware or unwanted applications to hide their presence from the macOS Dock and menu bar, effectively bypassing user detection and making the application run as a background process. The rule specifically looks for these two content strings within HTTP file data flowing to the client.
Suricata
