Fake Finder Bundle Validates Credential via PAM API (No dscl/security/osascript)
Detects the Finder application on macOS loading authentication modules (libpam.dylib) from within the 'Application Support' directory. The rule further correlates this by checking if common system utility tools (dscl, security, osascript) were initiated by the same Finder process path, flagging cases where legitimate system activity is absent, which may indicate potential dylib hijacking or suspicious process behavior.
Cortex XDR
