This rule detects the macOS Screen Sharing file copy helper SSFileCopyReceiver performing writes to locations that commonly grant persistence, including system-wide and per-user LaunchDaemons/LaunchAgents, shell startup files (.zshrc, .bash_profile, etc.), SSH authorized_keys, cron-related tabs, and hidden paths under root’s home directory. SSFileCopyReceiver executes writes as root on behalf of a remote viewer, and pre-auth exploitation of the Screen Sharing service (CVE-2026-65400) can abuse this primitive to establish persistence or execute payloads. The rule targets macOS endpoint events, focusing on the SSFileCopyReceiver process and specific file-patterns that indicate persistence artifacts (LaunchDaemons/LaunchAgents plist files, user and root shell startup files, authorized_keys, cron/tabs, and hidden root paths). It maps to MITRE ATT&CK techniques under Persistence: T1543 (Create or Modify System Process) with subtechniques Launch Agent (T1543.001) and Launch Daemon (T1543.004), T1546 (Unix Shell Configuration Modification, T1546.004), and T1098 (SSH Authorized Keys, T1098.004). The rule includes a KQL/ESQL query against endpoint file events, filtering for macOS hosts, non-deletion events, process.name = SSFileCopyReceiver, and file paths that match the persistence locations. It provides a full investigation guide, false positives guidance, remediation steps, related rules, and integration notes. Severity is high with a risk_score of 73. The rule is paired with an Elastic Defend setup description for macOS (Fleet-based deployment) and references guidance to investigate, contain, and remediate persistence introduced via Screen Sharing writes.