macOS: Self-Deletion of FLATROOF/ROOFDECK Binaries (SystemUpdate/iSync)
Detects the deletion of suspicious files associated with macOS malware families commonly referred to as FLATROOF or ROOFDECK. The rule monitors for the removal of files located in specific directories ('com.apple.iTunesCloud/SystemUpdate' or 'com.apple.internal.ck/iSync') using system utilities like 'rm' or via the 'loginwindow' process, which is indicative of malware attempting to clean its tracks after execution or persistence.
Cortex XDR
