Masquerading Finder/Software Update Bundle Launched Hidden from Application Support
Detects execution of processes named 'Finder' or 'Software Update' that originate from within the '/Library/Application Support/' directory on macOS. This pattern is indicative of potential masquerading where malicious binaries or persistent payloads are placed in shared application support folders to mimic legitimate system components.
Cortex XDR
