Meow RAT Gatekeeper Bypass: xattr quarantine removal and wallet app.asar overwrite on macOS
Detects various suspicious activities related to macOS wallet applications, including the removal of Gatekeeper quarantine flags, ad-hoc re-signing of application bundles, force-killing wallet applications, non-installer processes writing to application bundles (specifically 'app.asar'), and the use of 'dscl . authonly' which can be abused for fake password prompts.
Microsoft Sentinel (KQL)
