Update file_event_macos_malware_amos_persistence.yml

Author: JasonPhang98

rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml

@@ -17,12 +17,12 @@ logsource:
 detection:
     selection_user_helper:
         TargetFilename|contains|all:
-           - '/Users/'
-           - '.helper'
+            - '/Users/'
+            - '.helper'
     selection_user_agent:
         TargetFilename|contains|all:
-           - '/Users/'
-           - '.agent'
+            - '/Users/'
+            - '.agent'
     selection_launchdaemon:
         TargetFilename|endswith: '/Library/LaunchDaemons/com.finder.helper.plist'
     condition: 1 of selection_*