AMOS - Rapid Host Enumeration Sequence (T1082)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

This rule detects a rapid sequence of host profiling commands commonly used by the AMOS malware to gather system information, specifically to generate the hardware UUID of the victim machine. It looks for the execution of 'whoami', 'id', 'hostname', and 'ioreg' commands within a 10-second window, requiring at least three distinct commands from this set, with 'ioreg' being a mandatory component.