GhostLoader macOS NODE_CHANNEL markers

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•1•0•92

This rule detects the presence of specific 'NODE_CHANNEL' values ('anglmf', 'cryptoexth4', 'complexarchaeologist1') in process command lines or network event initiating process command lines on macOS systems. These values have been observed in the GhostClaw/GhostLoader malware campaign, indicating potential execution or network communication related to this threat.