AMOS macOS Staged Zip and Chunked Curl Exfiltration
This rule detects a multi-stage exfiltration technique observed on macOS systems, specifically targeting the AMOS malware. It correlates process execution events related to archiving (using 'ditto'), splitting files (using 'split'), and network connections involving 'curl' with specific headers or to known malicious infrastructure. The rule looks for a combination of these activities, indicating data staging and subsequent exfiltration in chunks.
Splunk (SPL)
