Hidden launch of staged Finder/Software Update masquerading bundle
Detects the execution of application bundles that mimic legitimate macOS system applications (Finder or Software Update) but originate from non-standard system paths. This behavior is indicative of masquerading techniques used by malware, such as the PamStealer, to execute hidden or unauthorized processes while appearing legitimate.
Microsoft Sentinel (KQL)
