PamStealer CIS-region locale/timezone/keyboard evasion check
Detects the execution of macOS command interpreters (osascript, sh, bash, zsh) where the command line arguments reference specific timezones (e.g., Moscow, Minsk) or locale settings (e.g., RU, BY, KZ, AM, AZ). This pattern is often associated with adversary attempts to detect or evade sandbox environments based on regional settings or to align with specific target geographic profiles.
Microsoft Sentinel (KQL)
