Datadog SHub Stealer and ClickFix Stager Detection
This rule detects indicators associated with the SHub Stealer v2.0 and MacSync infostealers. It looks for specific strings related to their components, update mechanisms, communication patterns, logging, and credential harvesting attempts. The rule identifies strings like "com.google.keystone.agent.plist", "GoogleUpdate.app", "api/bot/heartbeat", "osalogging.zip", "shub_log.zip", "dscl . authonly", and specific messages indicating password validation status. The presence of multiple such strings or specific combinations suggests the presence of these macOS infostealers.
YARA
