Silent Apple Notes NoteStore.sqlite theft via sudo -S cat
Detects silent theft of Apple Notes data via sudo -S cat against NoteStore.sqlite and its -wal/-shm companions from a non-Notes-app process, a technique AmnesiaStealer uses to avoid triggering a TCC prompt.
Microsoft Sentinel (KQL)
