A SOC Team’s Guide to Detecting macOS Atomic Stealers