AMOS macOS Persistence via com.finder.helper with User Context Pivot
This rule detects potential persistence mechanisms used by the AMOS malware on macOS systems. Specifically, it looks for the creation or execution of a launch daemon named 'com.finder.helper' in conjunction with other suspicious activities such as the execution of '.agent' or '.mainhelper' files, or commands used for user context pivoting . The rule also includes checks for VM detection attempts using 'system_profiler'. This combination of activities indicates a high likelihood of AMOS malware establishing persistence and attempting to escalate privileges or gather system information.
Splunk (SPL)
