AMOS Stealer Anti-VM Hardware Enumeration

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•8

This rule detects the execution of 'system_profiler' with command-line arguments 'SPMemoryDataType' or 'SPHardwareDataType'. This behavior is indicative of malware, specifically AMOS Stealer, attempting to enumerate system hardware and memory details to detect virtualized environments (e.g., QEMU, VMware) as an anti-analysis technique.