Meow RAT AppleScript Fake System Preferences Password Harvest
This rule detects the execution of AppleScript (osascript) to display fake System Preferences dialogs and the use of 'dscl . authonly' to validate credentials, which is indicative of the Meow RAT attempting to harvest macOS login passwords. The rule specifically looks for keywords in the command line that suggest a fake dialog (e.g., 'display dialog', 'LockedIcon.icns', 'System Preferences', 'hidden answer', 'default answer') or authentication validation via dscl.
Microsoft Sentinel (KQL)
