AMOS - Execution Wrapper Generation (T1543.004)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Detects the creation of the .agent shell wrapper file designed to supervise and restart the .mainhelper backdoor process.