Drew Pilarski
@barnabysDrew0 followers38 downloads8 copies17 likes303 views
9 detections
Filters
Last updated
All Time
Detection languages
9
Categories
4
4
4
2
2
Platforms
7
1
1
Products / Services
5
1
MITRE Techniques
3
3
2
2
2
Base64 Website Access
YARA-L
Detects a user accessing multiple websites commonly used for Base64 encoding and decoding within a short time frame. This activity could be a precursor to data exfiltration or an attempt to obfuscate malicious commands.
Detects processes accessing sensitive browser files which may indicate credential theft from web browsers.
Detects the execution of osascript with a command line that includes curl to download and execute a remote script, a technique used by the Odyssey Stealer malware.
Detects the execution of 'dscl . authonly' by a script interpreter, a technique used by Odyssey Stealer to validate user passwords obtained from a malicious dialog prompt.
Detects the creation of the 'socks' binary used by the Odyssey Stealer to establish a SOCKS5 proxy for network tunneling on compromised macOS systems. This rule identifies the binary based on specific SHA256 hashes and its filename 'socks'.
Detects the execution of an application from a mounted disk image (DMG) with a name known to be used by Odyssey Infostealer. This activity is indicative of initial access, where the user has been tricked into running a malicious application masquerading as a legitimate software installer or updater.
Detects the creation of a randomly named LaunchDaemon .plist file in /Library/LaunchDaemons/, a technique used by Odyssey Stealer for persistence.
Detects the creation of hidden configuration files used by the Odyssey Infostealer on macOS. These files are known to store sensitive data like passwords, C2 server details, and bot identifiers.
Detects a file being created in a temporary macOS directory, made executable, and then executed by a shell. This behavior is consistent with the Odyssey Infostealer, which downloads and runs scripts from temporary locations.