Detection of macOS XProtect and YARA Activity
This rule monitors for the execution or interaction with macOS native security components, specifically XProtect, XProtectRemediator, and YARA-based detection processes. It flags events related to these tools as potential security telemetry, scanning activities, or remediation actions.
CQL
