Meow RAT Persistence via com.apple.accountsd LaunchAgent/LaunchDaemon
Detects the installation of Meow RAT persistence mechanisms on macOS by monitoring for the creation or modification of specific LaunchAgent or LaunchDaemon .plist files, particularly those named 'com.apple.accountsd.plist', and subsequent 'launchctl load' commands for these files. This rule identifies attempts to establish persistence by masquerading as legitimate system processes.
Microsoft Sentinel (KQL)
