Aaron Bierlein

@JKL33

0 followers0 downloads4 copies0 likes33 views

2 detections

Filters

Last updated

All Time

Detection languages

Microsoft Sentinel (KQL)2

Platforms

macOS1

Products / Services

macOS Endpoint Security Framework1

MITRE Techniques

T1005 - Data from Local System1

T1555.003 - Credentials from Web Browsers1

TA0009 - Collection1

Atomic Stealer (AMOS) accessing Keychain, browser, and wallet data post curl|sh chain

KQL

This rule detects potential credential theft activity where a process spawning a command-line interpreter (bash, sh, zsh) using 'curl' simultaneously accesses sensitive browser configuration or credential directories on MacOS, such as Chrome, Firefox, or Safari application support paths. This pattern is indicative of an adversary attempting to exfiltrate browser-stored secrets.