macOS FileGrabber Infostealer Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•0•27

Detects the execution of the 'FileGrabber' component of the Amos infostealer on macOS. This rule specifically looks for command-line arguments containing both 'FileGrabber' and '/tmp', indicating the execution of this malicious component, which is known to target sensitive user files.