Cristian Marinescu
@Cristian13Completionist
0 followers0 downloads26 copies0 likes53 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Platforms
5
1
Products / Services
3
Detects execution of hidden binaries from /tmp using filenames that mimic Apple's internal naming convention (e.g., .com.apple.dt.<number>), a technique used by AmnesiaStealer's Stage 0 dropper to blend in with legitimate system processes and evade casual inspection.
Detects use of xattr to remove the com.apple.quarantine attribute from hidden files in /tmp, a key step in bypassing Gatekeeper before executing a dropped payload without triggering macOS security warnings.
Detects use of dscl -authonly to programmatically validate a user-supplied password against the local directory, a technique used by infostealers like AmnesiaStealer to confirm the captured credential is correct before using it to unlock the login keychain and escalate access to protected data.
Detects use of codesign to apply an ad-hoc signature to a hidden binary in /tmp, allowing it to execute on modern macOS without a valid developer certificate, typically performed immediately after quarantine removal as part of a Gatekeeper bypass chain.
Generic rule content from file: Potential OpenClaw | Clawdbot | Moltbot installation