Multi-Platform Infostealer Activity Detection
This rule detects various activities associated with multiple infostealers targeting macOS and Windows. It identifies the mounting of malicious Disk Image (DMG) files for DigitStealer and Atomic Stealer, curl-based exfiltration attempts by DigitStealer and MacSync, and renamed Python binaries used by PXA Stealer. The rule also looks for process execution patterns related to PXA Stealer, process injection involving cvtres.exe, and VBS/batch file drops and AutoIT abuse by Eternidade Stealer. Additionally, it detects network connections and scheduled task creation by Crystal PDF, as well as known malicious file hashes and network communication with known command and control (C2) domains associated with these threats.
Microsoft Sentinel (KQL)
