macOS.Gaslight Python stealer zip archive creation in /tmp before exfiltration
Detects macOS Python processes creating zip archives in temporary or 'collected_data' folders, potentially indicating data collection and exfiltration staging. The rule specifically looks for Python processes that have previously accessed sensitive paths like 'login.keychain-db' or performed data collection/compression activities.
Microsoft Sentinel (KQL)
