Atomic Stealer (AMOS) accessing Keychain, browser, and wallet data post curl|sh chain
This rule detects potential credential theft activity where a process spawning a command-line interpreter (bash, sh, zsh) using 'curl' simultaneously accesses sensitive browser configuration or credential directories on MacOS, such as Chrome, Firefox, or Safari application support paths. This pattern is indicative of an adversary attempting to exfiltrate browser-stored secrets.
Microsoft Sentinel (KQL)
