Fake Claude Code ads are installing AMOS on Macs

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/\/curl$/
| CommandLine=/\/api\/metrics\/run\?event=/
| table([@timestamp, ComputerName, ParentBaseFileName, CommandLine])
| head(200)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "curl"
| where ProcessCommandLine contains "/api/metrics/run?event="
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
      and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_name = "curl"
      and action_process_image_command_line contains "/api/metrics/run?event="
| fields _time, agent_hostname, actor_process_image_name, action_process_image_command_line
| limit 200

endpoint.os = "osx" event.type = "Process Creation" tgt.process.name = "curl" tgt.process.cmdline contains "/api/metrics/run?event="
| group n = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d Processes.process_name="curl" Processes.process="*/api/metrics/run?event=*"
    by Processes.dest Processes.parent_process_name Processes.process
| rename "Processes.*" as *
| head 200

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND process.name == "curl"
    AND process.command_line LIKE "*/api/metrics/run?event=*"
| KEEP @timestamp, host.name, process.parent.name, process.command_line
| LIMIT 200

title: Curl POSTing to the AMOS Kit's /api/metrics/run Paste Beacon
id: 3da61a9e-19fc-4c31-a937-89535edb4a22
status: experimental
description: |
    Detects curl reporting to /api/metrics/run?event=, the beacon every stage 2 of the AMOS kit behind
    fake Claude Code ads sends after the paste (event=pasted, and event=stager since 18 September 2026).
    The path is decoded before exec, so curl's command line carries it in clear.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.execution
    - attack.t1059.004
    - detection.emerging-threats
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/curl'
        CommandLine|contains: '/api/metrics/run\?event='
    condition: selection
falsepositives:
    - Unknown
level: high

event_platform=Mac
| in(field="#event_simpleName", values=[AsepFileChangeDetectInfo, AsepFileChangeScanInfo, ProcessRollup2])
| TargetFileName=/^\/Library\/LaunchDaemons\/com\.apple\.[^\/]+\.plist$/
    or (ASEPFilePath=/^\/Library\/LaunchDaemons\/com\.apple\.[^\/]+\.plist$/
        and ImageFileName!=/^\/(System|usr\/libexec)\//)
    or (#event_simpleName=ProcessRollup2 and ImageFileName=/\/launchctl$/
        and CommandLine=/(^|[\s"'=])\/Library\/LaunchDaemons\/com\.apple\.[^\s\/]+\.plist/)
| table([@timestamp, ComputerName, #event_simpleName, TargetFileName, ASEPFilePath, ImageFileName, CommandLine])
| head(200)

union
  (DeviceEvents
   | where Timestamp > ago(7d)
   | where ActionType == "PlistPropertyModified"
   | where FolderPath =~ "/Library/LaunchDaemons/"
   | where FileName startswith "com.apple."
   | project Timestamp, DeviceName, Detail = strcat(FolderPath, FileName), Actor = InitiatingProcessFileName),
  (DeviceFileEvents
   | where Timestamp > ago(7d)
   | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
   | where FolderPath matches regex @"^/Library/LaunchDaemons/com\.apple\.[^/]+\.plist$"
   | project Timestamp, DeviceName, Detail = FolderPath, Actor = InitiatingProcessFileName),
  (DeviceProcessEvents
   | where Timestamp > ago(7d)
   | where FileName =~ "launchctl"
   | where ProcessCommandLine contains "/Library/LaunchDaemons/com.apple."
   | where ProcessCommandLine matches regex @"(^|[\s""'=])/Library/LaunchDaemons/com\.apple\.[^\s/]+\.plist"
   | project Timestamp, DeviceName, Detail = ProcessCommandLine, Actor = InitiatingProcessFileName)
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
| filter (event_type = ENUM.FILE and event_sub_type in (ENUM.FILE_CREATE_NEW, ENUM.FILE_WRITE, ENUM.FILE_RENAME)
          and action_file_path contains "/Library/LaunchDaemons/com.apple."
          and action_file_path ~= "^/Library/LaunchDaemons/com\.apple\.[^/]+\.plist$"
          and (actor_process_signature_status = null
               or actor_process_signature_status != ENUM.SIGNED
               or actor_process_signature_vendor = null
               or actor_process_signature_vendor not in ("Software Signing", "macOS Software Signing")
               or actor_process_image_path ~= "^/(bin|sbin|usr/bin|usr/sbin)/"))
      or (event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
          and action_process_image_name = "launchctl"
          and action_process_image_command_line ~= "(^|\s)/Library/LaunchDaemons/com\.apple\.[^\s/]+\.plist"
          and (actor_process_signature_status = null
               or actor_process_signature_status != ENUM.SIGNED
               or actor_process_signature_vendor = null
               or actor_process_signature_vendor not in ("Software Signing", "macOS Software Signing")
               or actor_process_image_path ~= "^/(bin|sbin|usr/bin|usr/sbin)/"))
| comp count() as n, count_distinct(agent_id) as hosts by event_type, event_sub_type, actor_process_image_path, actor_process_signature_vendor
| sort desc n
| limit 100

endpoint.os = "osx" ((event.type in ("File Creation", "File Modification", "File Rename") tgt.file.path matches "^/Library/LaunchDaemons/com\\.apple\\.[^/]+\\.plist$") or (event.type = "Process Creation" tgt.process.name = "launchctl" tgt.process.cmdline matches "(^|\\s)/Library/LaunchDaemons/com\\.apple\\.[^/ ]+\\.plist"))
| group n = count(), hosts = estimate_distinct(agent.uuid) by event.type, src.process.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Filesystem
    where earliest=-7d Filesystem.file_path="/Library/LaunchDaemons/com.apple.*"
          Filesystem.action IN ("created", "modified")
    by Filesystem.dest Filesystem.file_path
| rename "Filesystem.*" as *
| where match(file_path, "^/Library/LaunchDaemons/com\\.apple\\.[^/]+\\.plist$")
| eval branch="file"
| append
    [| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
        from datamodel=Endpoint.Processes
        where earliest=-7d Processes.process_name="launchctl"
              Processes.process="*/Library/LaunchDaemons/com.apple.*"
        by Processes.dest Processes.process
    | rename "Processes.*" as *
    | where match(process, "(^|[\\s\"'=])/Library/LaunchDaemons/com\\.apple\\.[^\\s/]+\\.plist")
    | eval branch="launchctl"]
| head 200

FROM logs-endpoint.events.*
| WHERE host.os.type == "macos"
    AND (file.path RLIKE "/Library/LaunchDaemons/com\\.apple\\.[^/]+\\.plist"
         OR (process.name == "launchctl" AND process.command_line LIKE "*/Library/LaunchDaemons/com.apple.*"))
| KEEP @timestamp, host.name, event.category, file.path, process.command_line
| LIMIT 200

title: Apple-Labelled LaunchDaemon Written to /Library/LaunchDaemons
id: 0e33e896-57db-483f-9815-e83feb99e172
related:
    - id: 9487655e-438c-46c0-b57c-f8d62155709a
      type: similar
status: experimental
description: |
    Detects a com.apple.* property list written to /Library/LaunchDaemons. Apple's own daemons live in
    /System/Library/LaunchDaemons; the AMOS kit's backdoor installs com.apple.accountsd.helper and
    com.apple.metadata.mds.worker here.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.persistence
    - attack.t1543.004
    - attack.stealth
    - attack.t1036.005
logsource:
    product: macos
    category: file_event
detection:
    selection:
        TargetFilename|startswith: '/Library/LaunchDaemons/com.apple.'
        TargetFilename|endswith: '.plist'
    filter_main_apple:
        Image|startswith:
            - '/System/Library/'
            - '/usr/libexec/'
    condition: selection and not filter_main_apple
falsepositives:
    - Legacy Apple or third-party installers that place com.apple-named daemons in /Library
level: high
---
title: Launchctl Loading an Apple-Labelled Daemon from /Library/LaunchDaemons
id: 9487655e-438c-46c0-b57c-f8d62155709a
related:
    - id: 0e33e896-57db-483f-9815-e83feb99e172
      type: similar
status: experimental
description: |
    Detects launchctl loading a com.apple.* property list from /Library/LaunchDaemons rather than
    /System/Library/LaunchDaemons, as the AMOS kit's backdoor does for its persistence modules.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.persistence
    - attack.t1543.004
    - attack.stealth
    - attack.t1036.005
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/launchctl'
        CommandLine|re: '(^|[\s"''=])/Library/LaunchDaemons/com\.apple\.[^\s/]+\.plist'
    condition: selection
falsepositives:
    - Legacy Apple or third-party installers that place com.apple-named daemons in /Library
level: high

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/\/Library\/Application Support\/\.com\.apple\.[^\/]+\//
    or CommandLine=/\/Library\/Application Support\/\.com\.apple\.[^\/]+\//
| table([@timestamp, ComputerName, ImageFileName, ParentBaseFileName, CommandLine])
| head(200)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FolderPath contains "/Library/Application Support/.com.apple."
    or ProcessCommandLine contains "/Library/Application Support/.com.apple."
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName, ProcessCommandLine
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
      and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_path contains "/Library/Application Support/.com.apple."
      or action_process_image_command_line contains "/Library/Application Support/.com.apple."
| fields _time, agent_hostname, action_process_image_path, actor_process_image_name, action_process_image_command_line
| limit 200

endpoint.os = "osx" event.type = "Process Creation" (tgt.process.image.path contains "/Library/Application Support/.com.apple." or tgt.process.cmdline contains "/Library/Application Support/.com.apple.")
| group n = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d (Processes.process_path="*/Library/Application Support/.com.apple.*"
          OR Processes.process="*/Library/Application Support/.com.apple.*")
    by Processes.dest Processes.parent_process_name Processes.process_path Processes.process
| rename "Processes.*" as *
| head 200

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND (process.executable LIKE "*/Library/Application Support/.com.apple.*"
         OR process.command_line LIKE "*/Library/Application Support/.com.apple.*")
| KEEP @timestamp, host.name, process.executable, process.parent.name, process.command_line
| LIMIT 200

title: Process Running from a Hidden .com.apple Folder in Application Support
id: 1f91fb55-f8d0-4bfe-929b-a111ccdff39e
status: experimental
description: |
    Detects a process started from, or a command line launching, a hidden
    ~/Library/Application Support/.com.apple.*/ folder, where Apple keeps no executables. The AMOS kit's
    LaunchDaemons start the backdoor modules from there.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.stealth
    - attack.t1036.005
    - attack.t1564.001
    - attack.persistence
    - attack.t1543.004
logsource:
    product: macos
    category: process_creation
detection:
    selection_image:
        Image|contains: '/Library/Application Support/.com.apple.'
    selection_cli:
        CommandLine|contains: '/Library/Application Support/.com.apple.'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/\/openssl$/
| CommandLine=/base64\s+-d\s+-A/
| CommandLine!=/\s-(in|out)\s/
| ParentBaseFileName=/^(zsh|bash|sh)$/
| table([@timestamp, ComputerName, ParentBaseFileName, CommandLine])
| head(200)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "openssl"
| where ProcessCommandLine matches regex @"base64\s+-d\s+-A"
| where InitiatingProcessFileName in~ ("zsh", "bash", "sh")
| where isempty(InitiatingProcessCommandLine)
    or InitiatingProcessCommandLine matches regex @"^-?(\S*/)?(zsh|bash|sh)(\s+(-[il]{1,2}|--login))*\s*$"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
      and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_name = "openssl"
      and action_process_image_command_line ~= "base64\s+-d\s+-A"
      and actor_process_image_name in ("zsh", "bash", "sh")
| filter action_process_image_command_line !~= "\s-(in|out)\s"
| filter actor_process_command_line ~= "^-?(\S*/)?(zsh|bash|sh)(\s+(-[il]{1,2}|--login))*\s*$"
| comp count() as n, count_distinct(agent_id) as hosts by actor_process_image_name, causality_actor_process_image_name
| limit 50

endpoint.os = "osx" event.type = "Process Creation" tgt.process.name = "openssl" tgt.process.cmdline matches "base64\\s+-d\\s+-A" src.process.name in ("zsh", "bash", "sh") !(tgt.process.cmdline contains " -in ") !(tgt.process.cmdline contains " -out ") src.process.cmdline matches "^-?(\\S*/)?(zsh|bash|sh)(\\s+(-[il]{1,2}|--login))*\\s*$"
| group n = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d Processes.process_name="openssl" Processes.process="*base64*"
          Processes.parent_process_name IN ("zsh", "bash", "sh")
    by Processes.dest Processes.parent_process Processes.process
| rename "Processes.*" as *
| where match(process, "base64\\s+-d\\s+-A") AND NOT match(process, "\\s-(in|out)\\s")
    AND match(parent_process, "^-?(\\S*/)?(zsh|bash|sh)(\\s+(-[il]{1,2}|--login))*\\s*$")
| head 200

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND process.name == "openssl"
    AND process.command_line RLIKE ".*base64[ ]+-d[ ]+-A.*"
    AND process.parent.name IN ("zsh", "bash", "sh")
| KEEP @timestamp, host.name, process.parent.name, process.command_line
| LIMIT 200

title: Openssl Base64 Decode Under an Interactive Shell
id: a8d91c34-98c1-41bc-b315-7632cb8cfe78
status: experimental
description: |
    Detects openssl base64 -d -A run directly by an interactive zsh, bash or sh, as when a user pastes a
    ClickFix-style command. The AMOS kit's pasted line decodes its stage-1 URL this way inside a command
    substitution.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.004
    - attack.stealth
    - attack.t1140
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/openssl'
        CommandLine|re: 'base64\s+-d\s+-A'
        ParentImage|endswith:
            - '/zsh'
            - '/bash'
            - '/sh'
    selection_interactive_parent:
        - ParentCommandLine|re: '^-?(\S*/)?(zsh|bash|sh)(\s+(-[il]{1,2}|--login))*\s*$'
        - ParentCommandLine: null
        - ParentCommandLine: ''
    condition: all of selection*
falsepositives:
    - Administrators decoding base64 by hand in Terminal
level: high

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/\/(zsh|bash|sh)$/
| CommandLine=/base64\s+-D\s*\|\s*(\/bin\/)?zsh/
    or CommandLine=/\/Library\/Caches\/DayNote\//
    or CommandLine=/cdn\.jsdelivr\.net\/gh\/[^\/\s]+\/[^\/\s]+@main\/autoupd\.note/
| table([@timestamp, ComputerName, ParentBaseFileName, CommandLine])
| head(200)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("zsh", "bash", "sh")
| where ProcessCommandLine matches regex @"base64\s+-D\s*\|\s*(/bin/)?zsh"
    or ProcessCommandLine contains "/Library/Caches/DayNote/"
    or ProcessCommandLine matches regex @"cdn\.jsdelivr\.net/gh/[^/\s]+/[^/\s]+@main/autoupd\.note"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, ProcessCommandLine
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
      and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_name in ("zsh", "bash", "sh")
| filter action_process_image_command_line ~= "base64\s+-D\s*\|\s*(/bin/)?zsh"
      or action_process_image_command_line contains "/Library/Caches/DayNote/"
      or action_process_image_command_line ~= "cdn\.jsdelivr\.net/gh/[^/\s]+/[^/\s]+@main/autoupd\.note"
| fields _time, agent_hostname, actor_process_image_path, action_process_image_command_line
| limit 200

endpoint.os = "osx" event.type = "Process Creation" tgt.process.name in ("zsh", "bash", "sh") (tgt.process.cmdline matches "base64\\s+-D\\s*\\|\\s*(/bin/)?zsh" or tgt.process.cmdline contains "/Library/Caches/DayNote/" or tgt.process.cmdline contains "@main/autoupd.note")
| group n = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d Processes.process_name IN ("zsh", "bash", "sh")
          (Processes.process="*base64*-D*zsh*" OR Processes.process="*/Library/Caches/DayNote/*"
           OR Processes.process="*@main/autoupd.note*")
    by Processes.dest Processes.parent_process_name Processes.process
| rename "Processes.*" as *
| where match(process, "base64\\s+-D\\s*\\|\\s*(/bin/)?zsh") OR like(process, "%/Library/Caches/DayNote/%")
    OR match(process, "cdn\\.jsdelivr\\.net/gh/[^/\\s]+/[^/\\s]+@main/autoupd\\.note")
| head 200

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND process.name IN ("zsh", "bash", "sh")
    AND (process.command_line RLIKE ".*base64[ ]+-D[ ]*[|][ ]*(/bin/)?zsh.*"
         OR process.command_line LIKE "*/Library/Caches/DayNote/*"
         OR process.command_line LIKE "*@main/autoupd.note*")
| KEEP @timestamp, host.name, process.parent.executable, process.command_line
| LIMIT 200

title: Signed-App Dropper Piping Base64 or a jsDelivr Note into Zsh
id: c9c4242e-7b2e-4bba-b886-c381ab4e545e
status: experimental
description: |
    Detects the shell started by the AMOS kit's Apple-signed DMG droppers: a dropped script that
    decodes with base64 -D and pipes into zsh, or a jsDelivr-hosted autoupd.note fetched into
    ~/Library/Caches/DayNote/. Gatekeeper passes the signed app, so this shell is the first
    observable step.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.stealth
    - attack.defense-impairment
    - attack.t1553.002
    - attack.t1140
    - attack.execution
    - attack.t1059.004
    - attack.command-and-control
    - attack.t1105
    - detection.emerging-threats
logsource:
    product: macos
    category: process_creation
detection:
    selection_shell:
        Image|endswith:
            - '/zsh'
            - '/bash'
            - '/sh'
    selection_cli_pipe:
        CommandLine|re: 'base64\s+-D\s*\|\s*(/bin/)?zsh'
    selection_cli_daynote:
        CommandLine|contains: '/Library/Caches/DayNote/'
    selection_cli_note:
        CommandLine|re: 'cdn\.jsdelivr\.net/gh/[^/\s]+/[^/\s]+@main/autoupd\.note'
    condition: selection_shell and 1 of selection_cli_*
falsepositives:
    - Unknown
level: high

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/\/openssl$/
| CommandLine=/enc\s+-d\s+-aes-128-ctr/
| CommandLine=/-iv\s+0{32}/
| table([@timestamp, ComputerName, ParentBaseFileName, CommandLine])
| head(200)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "openssl"
| where ProcessCommandLine contains "-aes-128-ctr"
| where ProcessCommandLine contains "-iv 00000000000000000000000000000000"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
      and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_name = "openssl"
      and action_process_image_command_line contains "-aes-128-ctr"
      and action_process_image_command_line contains "-iv 00000000000000000000000000000000"
| fields _time, agent_hostname, actor_process_image_name, action_process_image_command_line
| limit 200

endpoint.os = "osx" event.type = "Process Creation" tgt.process.name = "openssl" tgt.process.cmdline contains "-aes-128-ctr" tgt.process.cmdline contains "-iv 00000000000000000000000000000000"
| group n = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d Processes.process_name="openssl" Processes.process="*-aes-128-ctr*"
          Processes.process="*-iv 00000000000000000000000000000000*"
    by Processes.dest Processes.parent_process_name Processes.process
| rename "Processes.*" as *
| head 200

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND process.name == "openssl"
    AND process.command_line LIKE "*-aes-128-ctr*"
    AND process.command_line LIKE "*-iv 00000000000000000000000000000000*"
| KEEP @timestamp, host.name, process.parent.name, process.command_line
| LIMIT 200

title: Openssl AES-128-CTR Decryption with an All-Zero IV
id: f4dbb654-64e6-4913-89ca-7bc4bff1b03b
status: experimental
description: |
    Detects openssl decrypting AES-128-CTR with an all-zero IV, as the AMOS kit's AES stage-1 loader does.
    Legitimate scripts rarely use CTR mode with a fixed zero IV.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.stealth
    - attack.t1140
    - attack.t1027
    - attack.execution
    - attack.t1059.004
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/openssl'
        CommandLine|contains|all:
            - '-aes-128-ctr'
            - '-iv 00000000000000000000000000000000'
    condition: selection
falsepositives:
    - Unknown
level: high

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/^\/(private\/)?tmp\/(\.[A-Za-z0-9_]{4,16}|helper)$/
    or (ImageFileName=/\/xattr$/ and CommandLine=/-c\s+\/(private\/)?tmp\/(\.[A-Za-z0-9_]{4,16}|helper)(\s|$)/)
| table([@timestamp, ComputerName, ImageFileName, ParentBaseFileName, CommandLine])
| head(200)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FolderPath matches regex @"^/(private/)?tmp/(\.[A-Za-z0-9_]{4,16}|helper)$"
    or (FileName =~ "xattr" and ProcessCommandLine matches regex @"-c\s+/(private/)?tmp/(\.[A-Za-z0-9_]{4,16}|helper)(\s|$)")
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName, ProcessCommandLine
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
      and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_path ~= "^/(private/)?tmp/(\.[A-Za-z0-9_]{4,16}|helper)$"
      or (action_process_image_name = "xattr"
          and action_process_image_command_line ~= "-c\s+/(private/)?tmp/(\.[A-Za-z0-9_]{4,16}|helper)(\s|$)")
| fields _time, agent_hostname, action_process_image_path, actor_process_image_name, action_process_image_command_line
| limit 200

endpoint.os = "osx" event.type = "Process Creation" (tgt.process.image.path matches "^/(private/)?tmp/(\\.[A-Za-z0-9_]{4,16}|helper)$" or (tgt.process.name = "xattr" tgt.process.cmdline matches "-c\\s+/(private/)?tmp/(\\.[A-Za-z0-9_]{4,16}|helper)"))
| group n = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d (Processes.process_path="/tmp/*" OR Processes.process_path="/private/tmp/*"
          OR Processes.process_name="xattr")
    by Processes.dest Processes.parent_process_name Processes.process_name Processes.process_path Processes.process
| rename "Processes.*" as *
| where match(process_path, "^/(private/)?tmp/(\\.[A-Za-z0-9_]{4,16}|helper)$")
    OR (process_name="xattr" AND match(process, "-c\\s+/(private/)?tmp/(\\.[A-Za-z0-9_]{4,16}|helper)(\\s|$)"))
| head 200

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND (process.executable RLIKE "/(private/)?tmp/(\\.[A-Za-z0-9_]{4,16}|helper)"
         OR (process.name == "xattr" AND process.command_line RLIKE ".*-c[ ]+/(private/)?tmp/(\\.[A-Za-z0-9_]{4,16}|helper).*"))
| KEEP @timestamp, host.name, process.executable, process.parent.name, process.command_line
| LIMIT 200

title: Executable Launched from /tmp/helper or a Hidden /tmp Dotfile
id: 8659172b-c611-4262-8603-8494039c3914
status: experimental
description: |
    Detects a binary run from /tmp/helper or a hidden /tmp/.<random> file, or xattr -c clearing quarantine
    on one. Stage 2 of the AMOS kit drops the stealer there, clears its quarantine and runs it.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.stealth
    - attack.defense-impairment
    - attack.t1553.001
    - attack.t1564.001
    - attack.execution
    - attack.t1204.002
logsource:
    product: macos
    category: process_creation
detection:
    selection_exec:
        Image|re: '^/(private/)?tmp/(\.[A-Za-z0-9_]{4,16}|helper)$'
    selection_xattr:
        Image|endswith: '/xattr'
        CommandLine|re: '-c\s+/(private/)?tmp/(\.[A-Za-z0-9_]{4,16}|helper)(\s|$)'
    condition: 1 of selection_*
falsepositives:
    - Installers that unpack a helper binary to /tmp
level: high

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/\/osascript$/
| CommandLine=/hidden answer/i
| groupBy([ParentBaseFileName], function=[count(as=n), count(aid, distinct=true, as=hosts)])
| head(100)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "osascript"
| where ProcessCommandLine contains "hidden answer"
| summarize n = count(), hosts = dcount(DeviceId) by InitiatingProcessFileName
| take 100

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
      and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_name = "osascript"
      and action_process_image_command_line contains "hidden answer"
| comp count() as n, count_distinct(agent_id) as hosts by actor_process_image_name
| limit 100

endpoint.os = "osx" event.type = "Process Creation" tgt.process.name = "osascript" tgt.process.cmdline contains "hidden answer"
| group n = count(), hosts = estimate_distinct(agent.uuid) by src.process.name, src.process.parent.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d Processes.process_name="osascript" Processes.process="*hidden answer*"
    by Processes.parent_process_name
| rename "Processes.*" as *
| head 100

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND process.name == "osascript"
    AND process.command_line LIKE "*hidden answer*"
| STATS n = COUNT(*), hosts = COUNT_DISTINCT(host.name) BY process.parent.name
| LIMIT 100

title: Osascript Dialog with a Hidden Answer
id: 72585756-0381-4308-9ad4-9a3f5c217588
status: experimental
description: |
    Detects osascript showing a dialog with a hidden answer field, the password prompt AMOS poses as a
    system dialog. Group by parent process before alerting.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.credential-access
    - attack.t1056.002
    - attack.execution
    - attack.t1059.002
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/osascript'
        CommandLine|contains: 'hidden answer'
    condition: selection
falsepositives:
    - IT and MDM scripts that prompt for a password the same way; exclude them by parent or signer
level: high

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/\/curl$/
| CommandLine=/https?:\/\/[^\/\s]+\/curl\/([a-z0-9]{8,12}\/([A-Za-z0-9_-]{12,32}(\.(txt|dat|json))?|(update|setup)\.sh)|[0-9a-f]{64})([\s'"?]|$)/
    or CommandLine=/https?:\/\/[^\/\s]+\/f\/[a-z0-9_-]{20,24}\/[a-z0-9]{6,10}([\s'"]|$)/
    or CommandLine=/https?:\/\/[^\/\s]+\/[A-Za-z0-9_-]{43}\/[A-Za-z0-9_-]{2,16}\/update/
| table([@timestamp, ComputerName, ParentBaseFileName, CommandLine])
| head(200)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "curl"
| where ProcessCommandLine matches regex @"https?://[^/\s]+/curl/([a-z0-9]{8,12}/([A-Za-z0-9_-]{12,32}(\.(txt|dat|json))?|(update|setup)\.sh)|[0-9a-f]{64})([\s'""?]|$)"
    or ProcessCommandLine matches regex @"https?://[^/\s]+/f/[a-z0-9_-]{20,24}/[a-z0-9]{6,10}([\s'""]|$)"
    or ProcessCommandLine matches regex @"https?://[^/\s]+/[A-Za-z0-9_-]{43}/[A-Za-z0-9_-]{2,16}/update"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC
      and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_name = "curl"
| filter action_process_image_command_line ~= "https?://[^/\s]+/curl/([a-z0-9]{8,12}/([A-Za-z0-9_-]{12,32}(\.(txt|dat|json))?|(update|setup)\.sh)|[0-9a-f]{64})([\s'\"?]|$)"
      or action_process_image_command_line ~= "https?://[^/\s]+/f/[a-z0-9_-]{20,24}/[a-z0-9]{6,10}"
      or action_process_image_command_line ~= "https?://[^/\s]+/[A-Za-z0-9_-]{43}/[A-Za-z0-9_-]{2,16}/update"
| fields _time, agent_hostname, actor_process_image_name, action_process_image_command_line
| limit 200

endpoint.os = "osx" event.type = "Process Creation" tgt.process.name = "curl"
  (tgt.process.cmdline matches "https?://[^/ ]+/curl/([a-z0-9]{8,12}/([A-Za-z0-9_-]{12,32}(\\.(txt|dat|json))?|(update|setup)\\.sh)|[0-9a-f]{64})"
   or tgt.process.cmdline matches "https?://[^/ ]+/f/[a-z0-9_-]{20,24}/[a-z0-9]{6,10}"
   or tgt.process.cmdline matches "https?://[^/ ]+/[A-Za-z0-9_-]{43}/[A-Za-z0-9_-]{2,16}/update")
| group n = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort -n
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d Processes.process_name="curl"
          (Processes.process="*/curl/*" OR Processes.process="*/f/*" OR Processes.process="*/update*")
    by Processes.dest Processes.parent_process_name Processes.process
| rename "Processes.*" as *
| where match(process, "https?://[^/\\s]+/(curl/([a-z0-9]{8,12}/([A-Za-z0-9_-]{12,32}(\\.(txt|dat|json))?|(update|setup)\\.sh)|[0-9a-f]{64})|f/[a-z0-9_-]{20,24}/[a-z0-9]{6,10}|[A-Za-z0-9_-]{43}/[A-Za-z0-9_-]{2,16}/update)")
| head 200

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND process.name == "curl"
    AND process.command_line RLIKE ".*https?://[^/ ]+/(curl/([a-z0-9]{8,12}/([A-Za-z0-9_-]{12,32}(\\.(txt|dat|json))?|(update|setup)\\.sh)|[0-9a-f]{64})|f/[a-z0-9_-]{20,24}/[a-z0-9]{6,10}|[A-Za-z0-9_-]{43}/[A-Za-z0-9_-]{2,16}/update).*"
| KEEP @timestamp, host.name, process.parent.name, process.command_line
| LIMIT 200

title: Curl Fetching the AMOS Kit's Stage-1 or Payload URL Shapes
id: 61c147d4-df3f-4330-a4e5-21fa9685f8fd
status: experimental
description: |
    Hunts for curl fetching the AMOS kit's server-side URL shapes: stage 1 from
    /curl/<8-12>/<12-32>, with or without a .txt, .dat or .json extension, and payloads from
    /f/<22>/<8> or a 43-character builder-token path. The shapes outlive any one host but can
    change in one release.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.t1071.001
    - detection.threat-hunting
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/curl'
        CommandLine|re:
            - 'https?://[^/\s]+/curl/([a-z0-9]{8,12}/([A-Za-z0-9_-]{12,32}(\.(txt|dat|json))?|(update|setup)\.sh)|[0-9a-f]{64})([\s''"?]|$)'
            - 'https?://[^/\s]+/f/[a-z0-9_-]{20,24}/[a-z0-9]{6,10}([\s''"]|$)'
            - 'https?://[^/\s]+/[A-Za-z0-9_-]{43}/[A-Za-z0-9_-]{2,16}/update'
    condition: selection
falsepositives:
    - Other services that use similar random path layouts
level: medium

#event_simpleName=ProcessRollup2 event_platform=Mac
| ImageFileName=/\/stat$/
| CommandLine=/-f\s+"?%Su"?\s+\/dev\/console/
| UID=0
| groupBy([aid, ParentBaseFileName], function=[count(as=n)], limit=max)
| n >= 5000
| groupBy([ParentBaseFileName], function=[count(as=hosts), sum(n, as=events), max(n, as=max_per_host)])
| head(100)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "stat"
| where ProcessCommandLine matches regex @"-f\s+""?%Su""?\s+/dev/console"
| summarize n = count() by DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessParentFileName, hr = bin(Timestamp, 1h)
| where n >= 360
| summarize device_hours = count(), max_per_hour = max(n), first_hour = min(hr), last_hour = max(hr) by DeviceName, InitiatingProcessFileName, InitiatingProcessParentFileName
| take 100

config timeframe = 7d
| dataset = xdr_data
| filter agent_os_type = ENUM.AGENT_OS_MAC and event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_name = "stat" and action_process_image_command_line contains "%Su" and action_process_image_command_line contains "/dev/console"
| bin _time span = 1h
| comp count() as per_hour by agent_id, _time, causality_actor_process_image_name
| filter per_hour >= 300
| comp count() as hot_hours, count_distinct(agent_id) as hosts by causality_actor_process_image_name
| sort desc hot_hours
| limit 50

endpoint.os = "osx" event.type = "Process Creation" tgt.process.name = "stat" tgt.process.cmdline contains "%Su" tgt.process.cmdline contains "/dev/console"
| let hr = floor(timestamp / 3600000000000)
| group per_hour = count() by agent.uuid, hr, src.process.name
| filter per_hour >= 300
| group hot_hours = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort -hot_hours
| limit 50

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d Processes.process_name="stat" Processes.process="*%Su*/dev/console*"
    by Processes.dest Processes.parent_process_name _time span=1h
| rename "Processes.*" as *
| where count >= 300
| stats count as hot_hours dc(dest) as hosts by parent_process_name
| head 100

FROM logs-endpoint.events.process-*
| WHERE host.os.type == "macos"
    AND process.name == "stat"
    AND process.command_line LIKE "*%Su*/dev/console*"
| STATS n = COUNT(*), hosts = COUNT_DISTINCT(host.name) BY process.parent.name
| LIMIT 100

title: Console User Lookup via Stat
id: 87a66575-116b-40dd-9cee-b3d51b800683
name: macos_stat_console_user_lookup
status: experimental
description: |
    Base rule for the correlation below: stat -f %Su /dev/console, the console-user lookup the AMOS kit's
    backdoor loop runs every five seconds. MDM tools use the same lookup, so only its rate is of interest.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.persistence
    - attack.t1543.004
    - attack.execution
    - attack.t1059.004
    - detection.threat-hunting
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/stat'
        CommandLine|re: '-f\s+"?%Su"?\s+/dev/console'
    condition: selection
falsepositives:
    - MDM and login scripts that resolve the console user
level: low
---
title: Console User Lookup in a Tight Loop
id: 0639ac12-b93d-47bd-b08e-f36fa2a2c162
status: experimental
description: |
    Hunts for a parent that resolves the console user at least 360 times in an hour, the rate of the AMOS
    kit's backdoor loop (once every five seconds).
author: Mate Security
date: 2026-10-08
tags:
    - attack.persistence
    - attack.t1543.004
    - detection.threat-hunting
correlation:
    type: event_count
    rules:
        - macos_stat_console_user_lookup
    group-by:
        - ComputerName
        - ParentImage
    timespan: 1h
    condition:
        gte: 360
falsepositives:
    - MDM agents that poll the console user frequently
level: medium

#event_simpleName=DnsRequest
| DomainName=/claude/i
| DomainName=/\./
| DomainName!=/(^|\.)(claude\.ai|claude\.com|anthropic\.com|claudeusercontent\.com|claude\.site|claudemcpcontent\.com)\.?$/i
| DomainName!=/\.(lan|local|home|internal|box|localdomain)\.?$/i
| groupBy([DomainName], function=[count(as=n), count(aid, distinct=true, as=hosts)])
| sort(n, limit=200)
| head(200)

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "DnsQueryResponse"
| extend q = tolower(tostring(parse_json(AdditionalFields).DnsQueryString))
| where q contains "claude"
| where not(q matches regex @"(^|\.)(claude\.ai|claude\.com|anthropic\.com|claudeusercontent\.com|claudemcpcontent\.com|claude\.site)$")
| where q matches regex @"\.[a-z]{2,63}$" and not(q contains "anthropic.")
| summarize n = count(), hosts = dcount(DeviceId) by q
| top 200 by n
| take 200

config timeframe = 7d
| dataset = xdr_data
| filter event_type = ENUM.NETWORK and action_external_hostname contains "claude"
| filter action_external_hostname !~= "(^|\.)(claude\.ai|claude\.com|anthropic\.com|claudeusercontent\.com|claudemcpcontent\.com|claude\.site)$"
| comp count() as n, count_distinct(agent_id) as hosts by action_external_hostname
| sort desc n
| limit 200

event.dns.request contains "claude"
  !(event.dns.request matches "(^|\\.)(claude\\.ai|claude\\.com|anthropic\\.com|claudeusercontent\\.com|claude\\.site)$")
| group n = count(), hosts = estimate_distinct(agent.uuid) by event.dns.request, endpoint.os
| sort -n
| limit 100

| tstats summariesonly=false allow_old_summaries=true count min(_time) as first_seen max(_time) as last_seen
    from datamodel=Network_Resolution
    where earliest=-7d DNS.query="*claude*"
    by DNS.query
| rename "DNS.*" as *
| where NOT match(lower(query), "(^|\\.)(claude\\.ai|claude\\.com|anthropic\\.com|claudeusercontent\\.com|claudemcpcontent\\.com|claude\\.site)$")
| sort - count
| head 200

FROM logs-*
| WHERE dns.question.name LIKE "*claude*"
    AND NOT dns.question.name RLIKE "(.*\\.)?(claude\\.ai|claude\\.com|anthropic\\.com|claudeusercontent\\.com|claudemcpcontent\\.com|claude\\.site)"
| STATS n = COUNT(*), hosts = COUNT_DISTINCT(host.name) BY dns.question.name
| SORT n DESC
| LIMIT 200

title: DNS Query for a Claude-Branded Domain Outside Anthropic's Own
id: 1def6e86-0c47-48aa-b471-7a3aa7b4cb70
status: experimental
description: |
    Hunts for DNS queries for Claude-branded domains that are not Anthropic's, for review. The AMOS kit's
    lures sat on claude-desk-code.com and claude-desktop.com; the next storefront may borrow another brand.
references:
    - https://www.malware-traffic-analysis.net/2026/10/02/index.html
author: Mate Security
date: 2026-10-08
tags:
    - attack.resource-development
    - attack.t1583.001
    - attack.initial-access
    - attack.t1189
    - detection.threat-hunting
logsource:
    category: dns
detection:
    selection:
        query|contains: 'claude'
    filter_main_anthropic_exact:
        query:
            - 'claude.ai'
            - 'claude.com'
            - 'anthropic.com'
            - 'claudeusercontent.com'
            - 'claudemcpcontent.com'
            - 'claude.site'
    filter_main_anthropic_sub:
        query|endswith:
            - '.claude.ai'
            - '.claude.com'
            - '.anthropic.com'
            - '.claudeusercontent.com'
            - '.claudemcpcontent.com'
            - '.claude.site'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate third-party sites and integrations that use the Claude name
level: low