SHub Stealer Fake GoogleUpdate Persistence
This rule detects the creation or modification of specific files associated with the SHub v2.0 infostealer on macOS. It looks for a fake 'GoogleUpdate' binary within the '~/Library/Application Support/Google/' directory or a LaunchAgent plist file named 'com.google.keystone.agent.plist' in the 'LaunchAgents/' directory. These file paths are indicative of the SHub stealer's persistence mechanism, which impersonates legitimate Google update components.
Sigma
