MACOS Sploitlight TCC Bypass Importer CVE 2025 31199

Aaron Mog@AaronMogS2S

•updated Jul 28, 2025•1•2•34

Detects malicious Spotlight Importer (.mdimporter) files designed to bypass macOS TCC protections, as seen in the 'Sploitlight' exploit (CVE-2025-31199). The rule identifies importers that read a file's contents and leak them via logging.