Extend Atomic MacOS Stealer - FileGrabber Rules

rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml

@@ -0,0 +1,25 @@
+title: Atomic macOS Stealer Persistence Indicators
+id: e710a880-1f18-4417-b6a0-b5afdf7e3023
+status: experimental
+description: Detects creation of persistence artifacts placed by Atomic macOS Stealer in macOS systems. Recent Atomic macOS Stealer variants have been observed dropping these to maintain persistent access after compromise.
+references:
+    - https://moonlock.com/amos-backdoor-persistent-access
+author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
+date: 2025-10-02
+tags:
+    - attack.persistence
+    - attack.t1564.001
+    - attack.t1543.004
+    - detection.emerging-threats
+logsource:
+    category: file_event
+    product: macos
+detection:
+    selection_user_dotfiles:
+        TargetFilename|re: ^/Users/[^/]+/\.(helper|agent)$
+    selection_launchdaemon:
+        TargetFilename|re: ^/Library/LaunchDaemons/com\.finder\.helper\.plist$
+    condition: 1 of selection_*
+falsepositives:
+    - Unknown
+level: high

rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/proc_creation_macos_malware_amos_curl_post.yml

@@ -0,0 +1,26 @@
+title: MacOS Curl Exfiltration 
+id: e710a880-1f18-4417-b6a0-b5afdf7e33da
+status: experimental
+description: Detects execution of FileGrabber on macOS, which is associated with Amos infostealer campaigns targeting sensitive user files.
+references:
+    - https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
+    - https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing 
+author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
+date: 2025-10-02
+tags:
+    - attack.execution
+    - attack.t1059.002
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: macos
+detection:
+    selection:
+        CommandLine|contains|all:
+            - 'curl'
+            - 'POST'
+            - 'BuildID'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high