{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "MacSync is a modular macOS infostealer that targets high-value cloud and crypto assets; a negative result over the fleet provides assurance against an active campaign that bypasses traditional signature-based controls." }, "name": "MacSync Binary Persistence and Application Tampering", "type": "investigation", "labels": [ "hunt", "attack.t1543.001", "attack.t1071.001", "attack.t1573.002", "attack.t1113", "attack.t1548.004", "attack.t1539", "attack.t1552", "attack.t1491" ], "series": { "slug": "macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer", "index": 2, "title": "MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer", "total": 2 }, "related": [ { "hunt": "macsync-initial-access-clickfix", "reason": "The initial malvertising lure, curl loader, and AppleScript stealer are covered in the companion initial-access hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "macsync-scripted-execution-credential-theft", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "The MacSync RAT uses polymorphic loaders and mimics legitimate software updaters for persistence. This hunt is required because a single signature-based rule cannot correlate the existence of a rare LaunchAgent with specific WebSocket C2 over TLS and the unique TCC-bypass flags used by the capture helper, especially when the malware name rotates per victim.", "coverage": [ { "stage": "persistent-macho-rat", "steps": [ "rare-launchagents", "c2-network-activity", "file-activity-check" ], "status": "covered" }, { "stage": "screen-capture-helper", "steps": [ "tcc-bypass-behavior" ], "status": "covered" }, { "stage": "wallet-app-trojanization", "steps": [ "wallet-process-check" ], "status": "covered" }, { "stage": "initial-access-clickfix-lure", "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.", "status": "out_of_scope" }, { "stage": "background-zsh-loader", "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.", "status": "out_of_scope" }, { "stage": "dynamic-applescript-theft", "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "ClickFix Malvertising Lure", "slug": "initial-access-clickfix-lure", "tactic": "initial-access", "techniques": [ "T1566.002", "T1204.002", "T1059.004" ], "observables": [ "curl -sL [URL] | zsh", "claude.ai/share/", "Google Ads sponsored search for 'Claude Code'", "Display name 'Apple Support'" ] }, { "name": "Background ZSH Loader", "slug": "background-zsh-loader", "tactic": "execution", "techniques": [ "T1027", "T1140", "T1059.004" ], "observables": [ "daemon_function", "Base64 encoded gzip heredoc", "/tmp/osalogging.zip" ] }, { "name": "Dynamic AppleScript Stealer", "slug": "dynamic-applescript-theft", "tactic": "credential-access", "techniques": [ "T1059.002", "T1555.001", "T1548.004" ], "observables": [ "osascript in-memory execution", "Chromium Safe Storage AES key extraction", "TCC prompt for Full Disk Access", "User password phishing prompt", "Extraction of login keychain secrets" ] }, { "name": "Mach-O RAT and Persistence", "slug": "persistent-macho-rat", "tactic": "persistence", "techniques": [ "T1543.001", "T1071.001", "T1573.002" ], "observables": [ "85.206.161.241:8443", "WebSocket over TLS", "LaunchAgent plist creation in Home folder", ".mpwd credential file", ".zshrc modification" ] }, { "name": "Screen Recording Permission Capture", "slug": "screen-capture-helper", "tactic": "collection", "techniques": [ "T1113", "T1548.004" ], "observables": [ "Capture agent binary with blank icon", "--tcc-only command line flag", "-o [path] screenshot output", "TCC Screen Recording prompt" ] }, { "name": "Crypto Wallet Trojanization", "slug": "wallet-app-trojanization", "tactic": "impact", "techniques": [ "T1539", "T1552", "T1491" ], "observables": [ "Modification of 60+ wallet extensions", "Trojanized Ledger Wallet app", "Fake recovery phrase phishing HTML", "Targeting of 21 desktop wallet apps" ] } ], "summary": "A malvertising campaign for 'Claude Code' lures users to a legitimate shared conversation on claude.ai that instructs them to run a curl one-liner. This executes a multi-stage infection chain involving a background zsh loader, a dynamic AppleScript stealer that harvests credentials and keychain data, and a persistent Mach-O RAT. The attack concludes by gaining screen recording permissions and trojanizing crypto wallet applications to phish for recovery phrases." }, "severity": "high", "rationale": "Scope the hunt to macOS systems. Prioritize hosts belonging to developers or users with crypto-wallet software installed. Ensure network telemetry covers the lookback window to catch ephemeral C2 connections.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has established long-term persistence on a macOS host by installing a Mach-O RAT via a custom LaunchAgent and is using specialized capture agents to bypass TCC permissions and phish for crypto wallet recovery phrases.", "parameters": { "c2_ips": { "from": { "ref": "fake-claude-macsync", "kind": "article", "observed": "2026-08-17" }, "type": "list[ip]", "default": [ "85.206.161.241" ], "description": "Known MacSync RAT C2 IP addresses." }, "c2_port": { "from": { "ref": "fake-claude-macsync", "kind": "article", "observed": "2026-08-17" }, "type": "number", "default": "8443", "description": "The WebSocket port used by the RAT." }, "lead_hosts": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2026-08-17" }, "type": "list[host]", "default": [], "description": "Hostnames identified in the first step as having rare LaunchAgents; paste them here to filter the fan-out." }, "scope_hosts": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2026-08-17" }, "type": "list[host]", "default": [], "description": "Initial hostnames to scope the hunt; leave empty for fleet-wide search." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-08-17" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "wallet_keywords": { "from": { "ref": "fake-claude-macsync", "kind": "article", "observed": "2026-08-17" }, "type": "list[string]", "default": [ "ledger", "metamask", "phantom", "coinbase", "exodus", "trustwallet", "binance", "keplr", "solflare" ], "description": "Keywords for common crypto wallets to check for trojanization." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/fake-claude-macsync", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/fake-claude-macsync", "name": "Huntress \u2014 MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer" } ], "blind_spots": [ { "id": "endpoint-telemetry-gap", "risk": "A host without an agent contributes no scheduled job or process rows, leaving persistence unobserved.", "stage": "persistent-macho-rat", "question": "Are there unmanaged macOS devices in the estate that can run the RAT?", "requires": "an endpoint agent on every macOS host" }, { "id": "tcc-log-visibility", "risk": "The hunt sees the request for permission via process flags but cannot confirm if the permission was granted without TCC-specific logs.", "stage": "screen-capture-helper", "question": "Did the user accept the TCC prompt for screen recording?", "requires": "Unified Log Facility access to com.apple.tcc logs" }, { "id": "websocket-inspection", "risk": "The hunt sees the connection but remains blind to the content of the commands or the volume of data exfiltrated.", "stage": "persistent-macho-rat", "question": "What commands were sent over the TLS-encrypted WebSocket channel?", "requires": "TLS inspection of WebSocket traffic" } ] }, "name": "MacSync Binary Persistence and Application Tampering", "description": "This hunt identifies the post-infection binary stages of the MacSync Stealer. It targets the Mach-O RAT's persistence mechanism in the user's LaunchAgents directory, its WebSocket-based C2 channel, and the behavior of its specialized screen-capture helper. The hunt also examines the execution of common crypto-wallet applications to identify potential trojanization or theft activity. By correlating rare persistence entries with specific TCC-bypass command-line flags and known C2 network patterns, we identify compromised macOS systems that standard signature-based rules miss due to the polymorphic nature of the initial infection loaders. The triage phase links these behaviors with specific exfiltration artifacts like the hidden .mpwd credential store." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer", "index": 2, "title": "MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer", "total": 2 }, "coverage": [ { "stage": "persistent-macho-rat", "steps": [ "rare-launchagents", "c2-network-activity", "file-activity-check" ], "status": "covered" }, { "stage": "screen-capture-helper", "steps": [ "tcc-bypass-behavior" ], "status": "covered" }, { "stage": "wallet-app-trojanization", "steps": [ "wallet-process-check" ], "status": "covered" }, { "stage": "initial-access-clickfix-lure", "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.", "status": "out_of_scope" }, { "stage": "background-zsh-loader", "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.", "status": "out_of_scope" }, { "stage": "dynamic-applescript-theft", "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.", "status": "out_of_scope" } ], "rationale": "An adversary has established long-term persistence on a macOS host by installing a Mach-O RAT via a custom LaunchAgent and is using specialized capture agents to bypass TCC permissions and phish for crypto wallet recovery phrases.", "blind_spots": [ { "id": "endpoint-telemetry-gap", "risk": "A host without an agent contributes no scheduled job or process rows, leaving persistence unobserved.", "stage": "persistent-macho-rat", "question": "Are there unmanaged macOS devices in the estate that can run the RAT?", "requires": "an endpoint agent on every macOS host" }, { "id": "tcc-log-visibility", "risk": "The hunt sees the request for permission via process flags but cannot confirm if the permission was granted without TCC-specific logs.", "stage": "screen-capture-helper", "question": "Did the user accept the TCC prompt for screen recording?", "requires": "Unified Log Facility access to com.apple.tcc logs" }, { "id": "websocket-inspection", "risk": "The hunt sees the connection but remains blind to the content of the commands or the volume of data exfiltrated.", "stage": "persistent-macho-rat", "question": "What commands were sent over the TLS-encrypted WebSocket channel?", "requires": "TLS inspection of WebSocket traffic" } ], "scoping_notes": "Scope the hunt to macOS systems. Prioritize hosts belonging to developers or users with crypto-wallet software installed. Ensure network telemetry covers the lookback window to catch ephemeral C2 connections.", "beyond_detection": "The MacSync RAT uses polymorphic loaders and mimics legitimate software updaters for persistence. This hunt is required because a single signature-based rule cannot correlate the existence of a rare LaunchAgent with specific WebSocket C2 over TLS and the unique TCC-bypass flags used by the capture helper, especially when the malware name rotates per victim." } }, { "id": "rare-launchagents", "type": "query", "label": "Rare LaunchAgent Persistence", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT job_name, job_path, job_cmd_line, device_hostname, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_scheduled_job WHERE job_kind = 'launchd' AND LOWER(job_definition_path) NOT LIKE '/system/library/launchagents/%' AND LOWER(job_definition_path) LIKE '%/library/launchagents/%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY job_name, job_path, job_cmd_line, device_hostname HAVING host_count < 3", "surface": "hb_scheduled_job", "description": "Identify newly created or modified LaunchAgents in user directories that are rare across the fleet, excluding standard system paths.", "expected_signal": "Rows identify LaunchAgents seen on very few hosts. Legitimate updaters will have high counts, while the MacSync RAT mimics these names on single systems within the user's library folder." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare LaunchAgent Persistence", "reads": [ "job_name", "job_path", "job_cmd_line", "device_hostname", "job_kind", "job_definition_path", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT job_name, job_path, job_cmd_line, device_hostname, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_scheduled_job WHERE job_kind = 'launchd' AND LOWER(job_definition_path) NOT LIKE '/system/library/launchagents/%' AND LOWER(job_definition_path) LIKE '%/library/launchagents/%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY job_name, job_path, job_cmd_line, device_hostname HAVING host_count < 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rows identify LaunchAgents seen on very few hosts. Legitimate updaters will have high counts, while the MacSync RAT mimics these names on single systems within the user's library folder.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "job_name", "job_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "c2-network-activity", "type": "query", "label": "C2 Network Activity", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND dst_endpoint_port = {{c2_port}} AND ('{{lead_hosts}}' = '' OR instr(',' || '{{lead_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Detect network connections to the MacSync RAT infrastructure over the designated WebSocket port on the suspected hosts.", "expected_signal": "Any connection to the designated IP and port indicates active command and control by a MacSync RAT." }, "parents": [ { "id": "rare-launchagents" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "C2 Network Activity", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND dst_endpoint_port = {{c2_port}} AND ('{{lead_hosts}}' = '' OR instr(',' || '{{lead_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Any connection to the designated IP and port indicates active command and control by a MacSync RAT.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "tcc-bypass-behavior", "type": "query", "label": "TCC Bypass Behavior", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, time FROM hb_process_activity WHERE (instr(LOWER(process_cmd_line), '--tcc-only') > 0 AND instr(LOWER(process_cmd_line), ' -o ') > 0) AND ('{{lead_hosts}}' = '' OR instr(',' || '{{lead_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find processes executing with specific command-line flags used to automate screen capture, filtering for suspicious flag combinations.", "expected_signal": "Process events using specific flags described in the kill chain where -o is accompanied by --tcc-only. Legitimate applications rarely combine these flags." }, "parents": [ { "id": "rare-launchagents" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "TCC Bypass Behavior", "reads": [ "device_hostname", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, time FROM hb_process_activity WHERE (instr(LOWER(process_cmd_line), '--tcc-only') > 0 AND instr(LOWER(process_cmd_line), ' -o ') > 0) AND ('{{lead_hosts}}' = '' OR instr(',' || '{{lead_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Process events using specific flags described in the kill chain where -o is accompanied by --tcc-only. Legitimate applications rarely combine these flags.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "file-activity-check", "type": "query", "label": "MacSync Exfiltration Artifacts", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, activity_name, time FROM hb_file_activity WHERE (LOWER(file_name) = '.mpwd' OR LOWER(file_name) = 'osalogging.zip') AND ('{{lead_hosts}}' = '' OR instr(',' || '{{lead_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify specific hidden credential files and staging archives created by the RAT during theft.", "expected_signal": "Creation or modification of the hidden .mpwd file or the osalogging.zip archive. These are strong indicators of exfiltration intent." }, "parents": [ { "id": "rare-launchagents" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "MacSync Exfiltration Artifacts", "reads": [ "device_hostname", "file_name", "file_path", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, activity_name, time FROM hb_file_activity WHERE (LOWER(file_name) = '.mpwd' OR LOWER(file_name) = 'osalogging.zip') AND ('{{lead_hosts}}' = '' OR instr(',' || '{{lead_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Creation or modification of the hidden .mpwd file or the osalogging.zip archive. These are strong indicators of exfiltration intent.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "wallet-process-check", "type": "query", "label": "Wallet Application Activity", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{wallet_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{wallet_keywords}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND ('{{lead_hosts}}' = '' OR instr(',' || '{{lead_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify activity related to targeted crypto-wallet applications that may be trojanized.", "expected_signal": "Execution of wallet applications. When correlated with rare LaunchAgents and TCC bypass, this confirms the final stage of the MacSync kill chain." }, "parents": [ { "id": "rare-launchagents" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Wallet Application Activity", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "process_original_file_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{wallet_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{wallet_keywords}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND ('{{lead_hosts}}' = '' OR instr(',' || '{{lead_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Execution of wallet applications. When correlated with rare LaunchAgents and TCC bypass, this confirms the final stage of the MacSync kill chain.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "macsync-triage", "type": "analytic", "label": "MacSync Triage Agent", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "rare-launchagents", "c2-network-activity", "tcc-bypass-behavior", "file-activity-check", "wallet-process-check" ], "objective": "Determine whether a host shows the behavioral pattern of MacSync post-infection activity. Look specifically for the existence of the .mpwd file and the osalogging.zip staging artifact alongside rare LaunchAgents and TCC-bypass flags to confirm exfiltration intent.", "description": "Analyze the combined evidence of persistence, network C2, TCC-bypass behavior, and exfiltration artifacts to determine host compromise.", "max_iterations": 5, "expected_signal": "A per-host verdict citing the specific link between a rare LaunchAgent, C2 connections, and the presence of exfiltration markers like .mpwd.", "success_criteria": "A detailed verdict of malicious | suspicious | benign citing row evidence for each host deemed suspicious." }, "parents": [ { "id": "c2-network-activity", "kind": "merge" }, { "id": "tcc-bypass-behavior", "kind": "merge" }, { "id": "file-activity-check", "kind": "merge" }, { "id": "wallet-process-check", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host based on the link between a rare LaunchAgent, WebSocket C2 connectivity, and confirmed exfiltration artifacts like .mpwd or osalogging.zip", "condition": "the triage verdict is malicious for at least one host based on the link between a rare LaunchAgent, WebSocket C2 connectivity, and confirmed exfiltration artifacts like .mpwd or osalogging.zip", "blind_spot": "endpoint-telemetry-gap", "confidence": "high", "description": "Branch based on the triage verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "macsync-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate Host", "config": { "target": "endpoint", "description": "Prevent further exfiltration of credentials or crypto wallet data.", "instructions": "Isolate the host immediately via EDR to stop active WebSocket C2 and file exfiltration. Do not reboot to preserve memory-resident artifacts.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-forensic-review", "type": "task", "label": "Analyst Forensic Review", "config": { "assignee": "analyst", "description": "Manually verify the presence of the .mpwd credential file and investigate wallet tampering.", "instructions": "Check for the existence of /tmp/osalogging.zip and the hidden .mpwd file in the user's home folder. Verify the contents of the identified LaunchAgent plist. If wallet applications were executed, initiate rotation of all crypto seeds and credentials." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out-report", "type": "task", "label": "Close-out Report", "config": { "assignee": "analyst", "description": "Finalize findings and record detection tuning notes.", "instructions": "Record the hunt outcome. If false positives were found on legitimate internal updaters, add their LaunchAgent paths to the exclusion list for the standing detection rule." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-forensic-review" } ] } ] }