Add ClickLock Stealer macOS Detection Rules

rules-emerging-threats/2026/Malware/ClickLock-Stealer/file_event_macos_malware_clicklock_artifacts.yml

@@ -0,0 +1,39 @@
+title: ClickLock Stealer File Artifacts
+id: aaef3aca-48ac-4ec5-8d2d-51e24ed9c98d
+status: experimental
+description: |
+    Detects persistence and staging artifacts associated with ClickLock Stealer, including its credential-stealing LaunchAgents, hidden module
+    directory, and the persistent GSocket backdoor masquerading as an iCloud component.
+references:
+    - https://www.group-ib.com/blog/clicklock-stealer-macos-malware/
+author: Robbin Ooi Zhen Heng
+date: 2026-07-28
+tags:
+    - attack.persistence
+    - attack.privilege-escalation
+    - attack.stealth
+    - attack.t1036.005
+    - attack.t1543.001
+    - attack.t1564.001
+    - detection.emerging-threats
+logsource:
+    category: file_event
+    product: macos
+detection:
+    selection_launchagent:
+        TargetFilename|startswith: '/Users/'
+        TargetFilename|endswith:
+            - '/Library/LaunchAgents/com.authirity.plist'
+            - '/Library/LaunchAgents/com.chromer.plist'
+    selection_modules:
+        TargetFilename|startswith: '/Users/'
+        TargetFilename|endswith:
+            - '/.cacheb/zoom'
+            - '/.cacheb/chromer'
+    selection_backdoor:
+        TargetFilename|startswith: '/Users/'
+        TargetFilename|contains: '/Library/Application Support/iCloudsync/'
+    condition: 1 of selection_*
+falsepositives:
+    - Unlikely
+level: high

rules-emerging-threats/2026/Malware/ClickLock-Stealer/proc_creation_macos_malware_clicklock_keychain_access.yml

@@ -0,0 +1,31 @@
+title: ClickLock Stealer Chrome Safe Storage Key Access
+id: deb0c2e6-fda5-43ed-8bea-0dfab4650772
+status: experimental
+description: |
+    Detects a shell script invoking the macOS security utility to retrieve a browser Safe Storage key. ClickLock Stealer uses this behavior while
+    coercing the victim to approve a genuine Keychain prompt, allowing stolen Chromium data to be decrypted offline.
+references:
+    - https://www.group-ib.com/blog/clicklock-stealer-macos-malware/
+author: Robbin Ooi Zhen Heng
+date: 2026-07-28
+tags:
+    - attack.credential-access
+    - attack.t1555.001
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: macos
+detection:
+    selection:
+        Image|endswith: '/security'
+        ParentImage|endswith:
+            - '/bash'
+            - '/sh'
+            - '/zsh'
+        CommandLine|contains|all:
+            - 'find-generic-password'
+            - 'Safe Storage'
+    condition: selection
+falsepositives:
+    - Legitimate shell scripts that retrieve browser Safe Storage keys from Keychain.
+level: high