Unpatched macOS hosts actively exposing Screen Sharing (listening) below fixed builds
Flags macOS hosts below fixed builds (26.6.1/15.7.9/14.8.9) with an actively listening Screen Sharing process, distinguishing genuinely exposed unpatched hosts from mere version drift.
Microsoft Sentinel (KQL)

