Malicious bundle masquerading as Finder/Software Update staged under Application Support
Detects file creation, modification, or renaming events within sensitive macOS Application Support directories that mimic core system components such as Finder or Software Update. This behavior is indicative of potential masquerading or persistence techniques where an attacker replaces legitimate application resources with malicious ones.
Microsoft Sentinel (KQL)
