macOS Stealer - Payload Staging in Tmp (T1074.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•7

Detects curl or wget fetching a secondary payload (like AMOS or ClearFake) directly into the /tmp directory, a volatile location to hide execution artifacts. The rule specifically looks for command-line arguments that use '-o' to specify a destination path within /tmp with common executable or package extensions.