AmnesiaStealer multi-command host recon correlated with system_info.json write
Detects correlated host and geolocation reconnaissance (sw_vers, whoami, ioreg, system_profiler) executed in quick succession by a non-standard process and written to a system_info.json file, matching AmnesiaStealer's recon routine.
Microsoft Sentinel (KQL)
