CmdID

CmdID / Commands

mdfind

List files matching a query. tldr-pages

On macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Find a file by its name

mdfind -name fileIdentify

Find a file by its content

mdfind "query"Identify

Find a file containing a string, in a given directory

mdfind -onlyin directory "query"Identify

What detects it

Sigma process creation rules that name mdfind
informationalFile and Directory Discovery - MacOSDaniil Yugoslavskiy, oscd.community