All Detections

macOS Re-opened Applications Modified

avatar
Darshan Thummar@Mighty
updated Jun 13, 2026003

Detects modification of macOS re-opened applications list for persistence on login

Microsoft Sentinel (KQL)