macOS Stealer - Archive Generation for Exfiltration (T1560.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•3

This rule correlates the credential scraping phase with the invocation of zip, tar, or ditto to compress stolen artifacts into a single file in the /tmp directory. Specifically, it looks for these archiving utilities being executed with a command line that targets a .zip or .tar.gz file within /tmp, and joins this activity with the prior access of a file named 'Login Data' by the same initiating process.