macOS File Persistence from Atomic MacOS Stealer (helper file and LaunchDaemon plist)
Flags macOS file creations used as persistence artifacts: per-user .helper files and a specific LaunchDaemon plist.
- Product
- macos
- Category
- file_event
- Author
- Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) (SigmaHQ), DRL 1.1
- Published
- 2025-11-22
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule looks for macOS persistence artifacts commonly used by Atomic MacOS Stealer variants: a user-level helper file created under /Users/<username> ending in .helper via a curl execution path, and a system LaunchDaemon plist at /Library/LaunchDaemons/com.finder.helper.plist. Persistence matters because it allows continued execution after initial compromise. The detection relies on file event telemetry that captures process filename endings and targeted file paths, including the LaunchDaemons plist creation.
Reporting behind it
- moonlock.comhttps://moonlock.com/amos-backdoor-persistent-access
- github.comhttps://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS File Persistence from Atomic MacOS Stealer (helper file and LaunchDaemon plist)
id: f0ba86bb-07af-4f97-b8b4-aa3e7585abe3
status: experimental
description: "This rule looks for macOS persistence artifacts commonly used by Atomic MacOS Stealer variants: a user-level helper file created under /Users/<username> ending in .helper via a curl execution path, and a system LaunchDaemon plist at /Library/LaunchDaemons/com.finder.helper.plist. Persistence matters because it allows continued execution after initial compromise. The detection relies on file event telemetry that captures process filename endings and targeted file paths, including the LaunchDaemons plist creation."
references:
- https://moonlock.com/amos-backdoor-persistent-access
- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml
author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital), Huntrule Team
date: 2025-11-22
tags:
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1564.001
- attack.t1543.004
- detection.emerging-threats
logsource:
category: file_event
product: macos
detection:
selection_user_helper:
Image|endswith: /curl
TargetFilename|startswith: /Users/
TargetFilename|endswith: .helper
selection_launchdaemon:
TargetFilename: /Library/LaunchDaemons/com.finder.helper.plist
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: e710a880-1f18-4417-b6a0-b5afdf7e3023
type: derived