macOS File Persistence Indicators for Atomic MacOS Stealer Artifacts

title: macOS File Persistence Indicators for Atomic MacOS Stealer Artifacts
id: f0ba86bb-07af-4f97-b8b4-aa3e7585abe3
status: experimental
description: This rule identifies creation of specific macOS persistence artifacts associated with Atomic MacOS Stealer activity. It matches file events where a curl-launched process writes a hidden per-user '.helper' file under /Users/<username>/ and where a LaunchDaemon plist is placed in /Library/LaunchDaemons/com.finder.helper.plist. These artifacts matter because they can enable continued access and execution after initial compromise. The detection relies on file event telemetry that captures the process command path and the target file paths being created.
references:
  - https://moonlock.com/amos-backdoor-persistent-access
  - https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml
author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital), Huntrule Team
date: 2025-11-22
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1564.001
  - attack.t1543.004
  - detection.emerging-threats
logsource:
  category: file_event
  product: macos
detection:
  selection_user_helper:
    Image|endswith: /curl
    TargetFilename|startswith: /Users/
    TargetFilename|endswith: .helper
  selection_launchdaemon:
    TargetFilename: /Library/LaunchDaemons/com.finder.helper.plist
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e710a880-1f18-4417-b6a0-b5afdf7e3023
    type: derived