macOS - Suspicious Unsigned Spotlight Importer Creation
Detects the creation or modification of an unsigned Spotlight importer (.mdimporter) bundle within a user's Library/Spotlight directory on macOS. This activity is indicative of the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker leverages a malicious, unsigned importer to gain unauthorized access to TCC-protected data via the mds/mdworker processes.
Microsoft Sentinel (KQL)
