{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "AMOS is a high-velocity threat targeting administrative credentials and cloud tokens on macOS; a phased hunt is required to confirm full infection chains rather than just noisy script activity." }, "name": "Atomic macOS (AMOS) Stealer Activity", "type": "investigation", "labels": [ "hunt", "attack.t1204.001", "attack.t1059.004", "attack.t1105", "attack.t1543.001", "attack.t1564.001", "attack.t1560.001", "attack.t1555", "attack.t1115" ], "series": { "slug": "atomic-macos-amos-stealer-activity", "index": 1, "title": "Atomic macOS (AMOS) Stealer Activity", "total": 2 }, "related": [ { "hunt": "macos-hidden-launch-persistence", "reason": "A broader hunt for any hidden launchd plists or binaries in unusual system directories would complement this AMOS-specific search.", "relation": "sibling" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule looking for curl piped to a shell generates high noise in developer environments. This hunt solves that by pivoting from the execution signal to fleet-wide rarity analysis of hidden Application Support folders, confirming a malicious pattern that a single rule cannot distinguish from legitimate administrative scripting.", "coverage": [ { "stage": "initial-access-copy-paste-terminal", "steps": [ "terminal-curl-pipe", "dns-to-amos-domains" ], "status": "covered" }, { "stage": "script-execution-and-payload-retrieval", "steps": [ "early-stage-triage" ], "status": "covered" }, { "stage": "persistence-via-hidden-application-support", "steps": [ "hidden-app-support-rarity" ], "status": "covered" }, { "stage": "credential-and-wallet-collection", "steps": [ "tmp-archive-creation" ], "status": "covered" }, { "stage": "c2-exfiltration-over-http", "reason": "This hunt focuses on endpoint lifecycle and local artifacts; exfiltration volume and C2 patterns belong to a network-centric hunt.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Deceptive Terminal Command Execution", "slug": "initial-access-copy-paste-terminal", "tactic": "initial-access", "techniques": [ "T1204.001", "T1059.004" ], "observables": [ "getmacouscloud.com", "curl -s hxxps://ferncore13.com/curl/...", "zsh -c \"$(curl ...)\"" ] }, { "name": "Scripted Payload Retrieval", "slug": "script-execution-and-payload-retrieval", "tactic": "execution", "techniques": [ "T1105", "T1059.004" ], "observables": [ "ferncore13.com", "grove-89.com", "/tmp/helper", "71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c", "7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a" ] }, { "name": "Hidden Application Support Persistence", "slug": "persistence-via-hidden-application-support", "tactic": "persistence", "techniques": [ "T1543.001", "T1564.001" ], "observables": [ "/tmp/starter", "~/Library/Application Support/.com.apple.accountsd/", "~/Library/Application Support/.com.apple.metadata.mds/", ".service", ".mdworker", "AccountsHelper", "mdworker_shared" ] }, { "name": "Credential and Wallet Harvesting", "slug": "credential-and-wallet-collection", "tactic": "collection", "techniques": [ "T1555", "T1115", "T1560.001" ], "observables": [ "/tmp/out.zip", "zsh_history", "deskwallets/Binance/", "FileGrabber/aws/", "FileGrabber/docker/", "Telegram Data/" ] }, { "name": "Command and Control Exfiltration", "slug": "c2-exfiltration-over-http", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1041" ], "observables": [ "161.35.146.120", "188.166.78.138", "stage=boot", "stage=credentials", "stage=wallets", "stage=browsers" ] } ], "summary": "Atomic macOS (AMOS) stealer infects users via deceptive toolkit setup pages that trick them into running Zsh scripts in Terminal. The malware establishes persistence through hidden directories and scripts in Application Support, harvests credentials and cryptocurrency wallets, and exfiltrates the staged data to C2 servers over HTTP." }, "severity": "high", "rationale": "The hunt focuses on macOS hosts (Darwin platform). Deceptive Terminal commands are a prerequisite for this specific AMOS variant.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has compromised a macOS host using deceptive Terminal setup commands to execute encoded shell scripts, establishing hidden persistence in Application Support and staging harvested data in temporary directories.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of macOS hostnames to narrow the scope." }, "amos_domains": { "from": { "ref": "unit42-amos-stealer", "kind": "article", "observed": "2026-08-05" }, "type": "list[domain]", "default": [ "getmacouscloud.com", "ferncore13.com", "grove-89.com", "malware-traffic-analysis.net" ], "description": "Known domains associated with AMOS delivery and infrastructure." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "name": "Atomic macOS (AMOS) Stealer Activity" } ], "blind_spots": [ { "id": "macos-file-visibility", "risk": "The hunt may fail to find persistence artifacts if the agent ignores hidden folders or lacks sufficient permissions.", "stage": "persistence-via-hidden-application-support", "question": "whether the endpoint agent can see file creations in hidden Application Support subdirectories", "requires": "full hb_file_activity coverage for hidden directories" }, { "id": "ephemeral-tmp-files", "risk": "If AMOS deletes its staging archive immediately after exfiltration, the file activity row may be missed if logging is not real-time.", "stage": "credential-and-wallet-collection", "question": "whether the /tmp/out.zip archive was created and deleted before the collector could record it", "requires": "real-time file monitoring for /tmp" } ] }, "name": "Atomic macOS (AMOS) Stealer Activity", "description": "This hunt targets the Atomic macOS (AMOS) stealer's end-to-end lifecycle on the endpoint. It begins by identifying the initial access vector: users copy-pasting curl-to-shell commands into Terminal. The hunt then moves through a phased flow, assessing early execution evidence before fanning out to search for high-fidelity persistence artifacts in hidden directories and evidence of data staging. By linking deceptive execution with rare file creations in Application Support, an analyst can confirm a successful infection even as malware indicators rotate." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "atomic-macos-amos-stealer-activity", "index": 1, "title": "Atomic macOS (AMOS) Stealer Activity", "total": 2 }, "coverage": [ { "stage": "initial-access-copy-paste-terminal", "steps": [ "terminal-curl-pipe", "dns-to-amos-domains" ], "status": "covered" }, { "stage": "script-execution-and-payload-retrieval", "steps": [ "early-stage-triage" ], "status": "covered" }, { "stage": "persistence-via-hidden-application-support", "steps": [ "hidden-app-support-rarity" ], "status": "covered" }, { "stage": "credential-and-wallet-collection", "steps": [ "tmp-archive-creation" ], "status": "covered" }, { "stage": "c2-exfiltration-over-http", "reason": "This hunt focuses on endpoint lifecycle and local artifacts; exfiltration volume and C2 patterns belong to a network-centric hunt.", "status": "out_of_scope" } ], "rationale": "An adversary has compromised a macOS host using deceptive Terminal setup commands to execute encoded shell scripts, establishing hidden persistence in Application Support and staging harvested data in temporary directories.", "blind_spots": [ { "id": "macos-file-visibility", "risk": "The hunt may fail to find persistence artifacts if the agent ignores hidden folders or lacks sufficient permissions.", "stage": "persistence-via-hidden-application-support", "question": "whether the endpoint agent can see file creations in hidden Application Support subdirectories", "requires": "full hb_file_activity coverage for hidden directories" }, { "id": "ephemeral-tmp-files", "risk": "If AMOS deletes its staging archive immediately after exfiltration, the file activity row may be missed if logging is not real-time.", "stage": "credential-and-wallet-collection", "question": "whether the /tmp/out.zip archive was created and deleted before the collector could record it", "requires": "real-time file monitoring for /tmp" } ], "scoping_notes": "The hunt focuses on macOS hosts (Darwin platform). Deceptive Terminal commands are a prerequisite for this specific AMOS variant.", "beyond_detection": "A single rule looking for curl piped to a shell generates high noise in developer environments. This hunt solves that by pivoting from the execution signal to fleet-wide rarity analysis of hidden Application Support folders, confirming a malicious pattern that a single rule cannot distinguish from legitimate administrative scripting." } }, { "id": "macos-scope", "type": "query", "label": "Identify macOS hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT hostname FROM hb_devices WHERE (LOWER(platform) = 'darwin' OR LOWER(platform) = 'macos') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_devices", "description": "Narrow the estate to macOS devices to ensure behavioral queries target the relevant platform.", "expected_signal": "A list of hostnames. Silence suggests no macOS devices are enrolled in the monitoring platform." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify macOS hosts", "reads": [ "hostname", "platform", "time" ], "source": "hb_devices", "target": "endpoint", "content": "SELECT DISTINCT hostname FROM hb_devices WHERE (LOWER(platform) = 'darwin' OR LOWER(platform) = 'macos') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames. Silence suggests no macOS devices are enrolled in the monitoring platform.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "terminal-curl-pipe", "type": "query", "label": "Deceptive terminal curl-to-shell", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%terminal%' OR LOWER(process_name) LIKE '%zsh%') AND instr(LOWER(process_cmd_line), 'curl') > 0 AND instr(LOWER(process_cmd_line), '|') > 0 AND instr(LOWER(process_cmd_line), 'zsh') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_process_activity", "description": "Identify instances of curl commands piped directly to a shell within Terminal or Zsh sessions, which is the primary delivery mechanism for AMOS.", "expected_signal": "Process activity showing a user-initiated pipe of remote content to an interpreter. This is a high-confidence indicator of the reported technique." }, "parents": [ { "id": "macos-scope" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Deceptive terminal curl-to-shell", "reads": [ "device_hostname", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%terminal%' OR LOWER(process_name) LIKE '%zsh%') AND instr(LOWER(process_cmd_line), 'curl') > 0 AND instr(LOWER(process_cmd_line), '|') > 0 AND instr(LOWER(process_cmd_line), 'zsh') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Process activity showing a user-initiated pipe of remote content to an interpreter. This is a high-confidence indicator of the reported technique.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "dns-to-amos-domains", "type": "query", "label": "DNS lookups to AMOS infrastructure", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE instr(',' || '{{amos_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_dns_activity", "description": "Corroborate deceptive commands with network connections to the domains listed in the research.", "expected_signal": "DNS resolutions for delivery domains. Silence is expected if the adversary has rotated domains, making behavioral queries critical." }, "parents": [ { "id": "macos-scope" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS lookups to AMOS infrastructure", "reads": [ "device_hostname", "process_name", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE instr(',' || '{{amos_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "DNS resolutions for delivery domains. Silence is expected if the adversary has rotated domains, making behavioral queries critical.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Assess early infection signals", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "terminal-curl-pipe", "dns-to-amos-domains" ], "objective": "Determine if any host likely executed a deceptive AMOS installation command based on Terminal process activity and related DNS lookups.", "description": "Evaluate if the Terminal activity and DNS patterns represent a likely AMOS deployment attempt.", "max_iterations": 4, "expected_signal": "A per-host verdict on delivery success.", "success_criteria": "A per-host verdict citing specific command lines or domains." }, "parents": [ { "id": "terminal-curl-pipe", "kind": "merge" }, { "id": "dns-to-amos-domains", "kind": "merge" } ] }, { "id": "hidden-app-support-rarity", "type": "query", "label": "Rare hidden Application Support paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(file_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_file_activity WHERE LOWER(file_path) LIKE '%/application support/.com.apple.%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY LOWER(file_path) HAVING hosts <= 5 ORDER BY hosts ASC", "surface": "hb_file_activity", "description": "Identify hidden directories within Application Support masquerading as Apple services, using fleet-wide rarity to filter out legitimate software.", "expected_signal": "Hidden file paths seen on few hosts, such as .com.apple.accountsd or .com.apple.metadata.mds. Legitimate app support folders are typically consistent across the fleet." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare hidden Application Support paths", "reads": [ "file_path", "device_hostname", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT LOWER(file_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_file_activity WHERE LOWER(file_path) LIKE '%/application support/.com.apple.%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY LOWER(file_path) HAVING hosts <= 5 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Hidden file paths seen on few hosts, such as .com.apple.accountsd or .com.apple.metadata.mds. Legitimate app support folders are typically consistent across the fleet.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "file_path" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "tmp-archive-creation", "type": "query", "label": "Staged collection archive in /tmp", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE LOWER(file_name) = 'out.zip' AND LOWER(file_path) LIKE '%/tmp/%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Search for the specific staging file AMOS creates to aggregate stolen credentials and wallet data.", "expected_signal": "Rows showing the creation of /tmp/out.zip. Silence confirms this specific artifact was not staged during the window." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Staged collection archive in /tmp", "reads": [ "device_hostname", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE LOWER(file_name) = 'out.zip' AND LOWER(file_path) LIKE '%/tmp/%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Rows showing the creation of /tmp/out.zip. Silence confirms this specific artifact was not staged during the window.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "full-infection-triage", "type": "analytic", "label": "Synthesize full infection chain", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-triage", "hidden-app-support-rarity", "tmp-archive-creation" ], "objective": "Analyze the full chain of activity, synthesisng the early execution evidence with follow-on persistence in hidden Application Support paths and ZIP staging in /tmp.", "description": "Link early Terminal activity with later persistence and staging evidence to confirm a complete AMOS infection.", "max_iterations": 6, "expected_signal": "A high-confidence verdict linking specific execution events to persistence and data staging.", "success_criteria": "A per-host verdict that classifies the threat as malicious if multiple stages of the chain are observed." }, "parents": [ { "id": "hidden-app-support-rarity", "kind": "merge" }, { "id": "tmp-archive-creation", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on infection verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict identifies a host with both deceptive Terminal activity and subsequent hidden Application Support persistence", "condition": "the triage verdict identifies a host with both deceptive Terminal activity and subsequent hidden Application Support persistence", "blind_spot": "macos-file-visibility", "confidence": "high", "description": "Direct the workflow to containment or manual review based on the synthesis of endpoint signals.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "full-infection-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate infected host", "config": { "target": "endpoint", "description": "Immediately isolate the host to prevent credential exfiltration and further lateral movement.", "instructions": "Isolate the host from the network and revoke any active cloud provider sessions associated with the user.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-forensics", "type": "task", "label": "Perform manual forensics", "config": { "assignee": "analyst", "description": "Verify the presence of Mach-O binaries and recover them for analysis.", "instructions": "Check the /tmp and Application Support directories for the hidden files identified by the agent. Collect hashes and samples of AccountsHelper or mdworker_shared if present. Review the user's terminal history and keychain for further signs of theft." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out and document", "config": { "assignee": "analyst", "description": "Document findings and update the detection strategy.", "instructions": "Document the identified hosts and their current status. If the terminal curl-to-shell query proved effective, recommend it for promotion to a detection rule. Note any new hidden paths discovered." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "manual-forensics" } ] } ] }