Meow RAT Trojanized Crypto Wallet app.asar Replacement on macOS
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
Microsoft Sentinel (KQL)
