Add PamStealer macOS detection rules

Author: warlocksmurf

rules-emerging-threats/2026/Malware/PamStealer/file_event_macos_malware_pamstealer_artifacts.yml

@@ -0,0 +1,44 @@
+title: PamStealer File Artifacts
+id: 6a4fd1ba-5d6a-4712-b068-fb1f9df23292
+status: experimental
+description: |
+    Detects file artifacts associated with PamStealer, including payloads staged in user-level application support directories that masquerade as
+    Apple components, infection marker files, and a helper executable impersonating System Settings.
+references:
+    - https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/
+author: Robbin Ooi Zhen Heng
+date: 2026-07-28
+tags:
+    - attack.persistence
+    - attack.privilege-escalation
+    - attack.stealth
+    - attack.t1036.005
+    - attack.t1547.015
+    - attack.t1564.001
+    - detection.emerging-threats
+logsource:
+    category: file_event
+    product: macos
+detection:
+    selection_staged_payload:
+        TargetFilename|startswith: '/Users/'
+        TargetFilename|contains:
+            - '/Library/Application Support/com.apple.finder.core/Finder.app/'
+            - '/Library/Application Support/com.apple.finder.monitor/Finder.app/'
+            - '/Library/Application Support/com.apple.security.daemon/Software Update.app/'
+            - '/Library/Application Support/com.apple.softwareupdated/SoftwareUpdateD'
+    selection_marker:
+        TargetFilename|startswith: '/Users/'
+        TargetFilename|contains:
+            - '/Library/Application Support/com.apple.finder.core/'
+            - '/Library/Application Support/com.apple.finder.monitor/'
+        TargetFilename|endswith:
+            - '/.Maccy'
+            - '/.config'
+            - '/.lock'
+    selection_helper:
+        TargetFilename|endswith: '/tmp/System Settings'
+    condition: 1 of selection_*
+falsepositives:
+    - Unlikely
+level: high

rules-emerging-threats/2026/Malware/PamStealer/proc_creation_macos_malware_pamstealer_clipboard_collection.yml

@@ -0,0 +1,27 @@
+title: PamStealer Clipboard Collection
+id: 2a24d2b2-1ded-499f-ae14-3adb80001d77
+status: experimental
+description: |
+    Detects pbpaste launched by a process staged in PamStealer's fake Finder application directories. PamStealer repeatedly launches pbpaste from
+    a process masquerading as Finder to collect clipboard contents.
+references:
+    - https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/
+author: Robbin Ooi Zhen Heng
+date: 2026-07-28
+tags:
+    - attack.collection
+    - attack.t1115
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: macos
+detection:
+    selection:
+        Image|endswith: '/pbpaste'
+        ParentImage|contains:
+            - '/Library/Application Support/com.apple.finder.core/Finder.app/'
+            - '/Library/Application Support/com.apple.finder.monitor/Finder.app/'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: high

rules-emerging-threats/2026/Malware/PamStealer/proc_creation_macos_malware_pamstealer_scripteditor_codesign.yml

@@ -0,0 +1,31 @@
+title: PamStealer Ad-Hoc Bundle Signing Via Script Editor
+id: 596e09c1-9617-4c21-8eb9-7cdb4227d300
+status: experimental
+description: |
+    Detects Script Editor spawning codesign to ad-hoc sign an application bundle staged below a user's Application Support directory. PamStealer
+    uses this behavior after its JXA dropper creates a fake Finder or Software Update application bundle.
+references:
+    - https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/
+author: Robbin Ooi Zhen Heng
+date: 2026-07-28
+tags:
+    - attack.defense-impairment
+    - attack.execution
+    - attack.t1059.007
+    - attack.t1553.002
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: macos
+detection:
+    selection:
+        Image|endswith: '/codesign'
+        ParentImage|endswith: '/Script Editor.app/Contents/MacOS/Script Editor'
+        CommandLine|contains|all:
+            - '-fs'
+            - '--deep'
+            - '/Library/Application Support/'
+    condition: selection
+falsepositives:
+    - Legitimate AppleScript development that ad-hoc signs application bundles from a user Application Support directory.
+level: high