Potential Data Exfiltration via Malicious Spotlight Indexing (Sploitlight)
Detects the use of the 'mdimport' command to index sensitive user directories. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where a malicious Spotlight importer is triggered to run within the 'mdworker' process and exfiltrate data from TCC-protected locations by writing it to the system log.
Microsoft Sentinel (KQL)
