AMOS LaunchDaemon Persistence Creation

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•5

Detects the creation, modification, or renaming of the 'com.finder.helper.plist' file in the '/Library/LaunchDaemons/' directory, which is a specific persistence mechanism used by the AMOS stealer malware. This rule specifically targets the root-level persistence method.