macOS process creation: FileGrabber or curl POST exfiltration indicators for Amos stealer

title: "macOS process creation: FileGrabber or curl POST exfiltration indicators for Amos stealer"
id: d4cdf73f-e8b1-4df1-a0b2-eb33c959c1c1
related:
  - id: e710a880-1f18-4417-b6a0-b5afdf7e305a
    type: obsolete
  - id: e710a880-1f18-4417-b6a0-b5afdf7e33da
    type: derived
status: experimental
description: This rule flags macOS process creation events that match either FileGrabber execution referencing /tmp or curl command lines issuing a POST containing markers typical of Amos data exfiltration (including a form file=@/tmp/out.zip). Such activity is important because it combines local collection staging in temporary directories with outbound transmission of sensitive artifacts to remote endpoints. Telemetry relies on macOS process creation command-line content containing specific strings associated with the targeted tools and exfiltration pattern.
references:
  - https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
  - https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing
  - https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L36
  - https://www.jamf.com/blog/infostealers-pose-threat-to-macos/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/proc_creation_macos_malware_amos_curl_post.yml
author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital), Huntrule Team
date: 2025-11-22
tags:
  - attack.execution
  - attack.t1059.002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: macos
detection:
  selection_curl_post:
    CommandLine|contains|all:
      - curl
      - POST
      - "user:"
      - "-H "
      - BuildID
      - file=@/tmp/out.zip
      - "cl: 0"
  selection_filegrabber_exec:
    CommandLine|contains|all:
      - FileGrabber
      - /tmp
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1