Sigma high experimental sigma

Atomic MacOS Stealer - Persistence Indicators

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

View Source

Detection Logic

{
  "selection_user_helper": {
    "Image
| endswith": "/curl",
    "TargetFilename
| startswith": "/Users/",
    "TargetFilename
| endswith": ".helper"
  },
  "selection_launchdaemon": {
    "TargetFilename": "/Library/LaunchDaemons/com.finder.helper.plist"
  },
  "condition": "1 of selection_*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...