macOS Stealer - Exfiltration via cURL POST (T1041)
Detects the final curl command utilized by AMOS or ClearFake transmitting the archived credentials to the remote C2 via a multipart form-data upload.
Microsoft Sentinel (KQL)
Detects the final curl command utilized by AMOS or ClearFake transmitting the archived credentials to the remote C2 via a multipart form-data upload.
Already have an account?