macOS Atomic Stealer FileGrabber and curl POST to exfiltrate /tmp/out.zip
Alert on macOS command lines showing FileGrabber from /tmp or curl POST exfiltration with /tmp/out.zip.
- Product
- macos
- Category
- process_creation
- Author
- Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) (SigmaHQ), DRL 1.1
- Published
- 2025-11-22
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags macOS process creation events associated with data exfiltration behavior: execution of FileGrabber with a /tmp target, or curl-based POST requests carrying specific headers and an attachment of /tmp/out.zip. Attackers commonly use these patterns to package local files and transmit them to remote infrastructure. The detection relies on process command-line telemetry and string matching for the FileGrabber invocation and the expected curl POST structure.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
- hunt.iohttps://hunt.io/blog/macos-clickfix-applescript-terminal-phishing
- github.comhttps://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L36
- jamf.comhttps://www.jamf.com/blog/infostealers-pose-threat-to-macos/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/proc_creation_macos_malware_amos_curl_post.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Atomic Stealer FileGrabber and curl POST to exfiltrate /tmp/out.zip
id: d4cdf73f-e8b1-4df1-a0b2-eb33c959c1c1
related:
- id: e710a880-1f18-4417-b6a0-b5afdf7e305a
type: obsolete
- id: e710a880-1f18-4417-b6a0-b5afdf7e33da
type: derived
status: experimental
description: "This rule flags macOS process creation events associated with data exfiltration behavior: execution of FileGrabber with a /tmp target, or curl-based POST requests carrying specific headers and an attachment of /tmp/out.zip. Attackers commonly use these patterns to package local files and transmit them to remote infrastructure. The detection relies on process command-line telemetry and string matching for the FileGrabber invocation and the expected curl POST structure."
references:
- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
- https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing
- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L36
- https://www.jamf.com/blog/infostealers-pose-threat-to-macos/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/proc_creation_macos_malware_amos_curl_post.yml
author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital), Huntrule Team
date: 2025-11-22
tags:
- attack.execution
- attack.t1059.002
- detection.emerging-threats
logsource:
category: process_creation
product: macos
detection:
selection_curl_post:
CommandLine|contains|all:
- curl
- POST
- "user:"
- "-H "
- BuildID
- file=@/tmp/out.zip
- "cl: 0"
selection_filegrabber_exec:
CommandLine|contains|all:
- FileGrabber
- /tmp
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1