Add ClickLock Stealer macOS Detection Rules

[warlocksmurf]

Summary of the Pull Request

Adds two experimental macOS detection rules for ClickLock Stealer based on Group-IB research.

The rules detect:

• Persistence and staging artifacts associated with the credential-stealing LaunchAgents and hidden modules, plus the persistent GSocket backdoor disguised as an iCloud component.
• Shell-driven access to the Chrome Safe Storage key through the macOS security utility.

Reference:

• https://www.group-ib.com/blog/clicklock-stealer-macos-malware/

Changelog

new: ClickLock Stealer File Artifacts
new: ClickLock Stealer Chrome Safe Storage Key Access

Example Log Event

ClickLock credential-stealer LaunchAgent:
TargetFilename: /Users/alice/Library/LaunchAgents/com.authirity.plist

ClickLock Keychain-stealer LaunchAgent:
TargetFilename: /Users/alice/Library/LaunchAgents/com.chromer.plist

ClickLock hidden credential-stealer module:
TargetFilename: /Users/alice/.cacheb/zoom

ClickLock hidden Keychain-stealer module:
TargetFilename: /Users/alice/.cacheb/chromer

ClickLock persistent GSocket backdoor:
TargetFilename: /Users/alice/Library/Application Support/iCloudsync/iCloud

ClickLock Chrome Safe Storage key access:
Image: /usr/bin/security
ParentImage: /bin/bash
CommandLine: /usr/bin/security find-generic-password -w -s "Chrome Safe Storage"

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions