DarkSword Implant Log Messages
Detects specific log messages written to the iOS Unified Log by the DarkSword implant (GHOSTBLADE). These messages, which include tags like '[DarkSword-WIFI-DUMP]' and '[MAIN]', are unique to the malware and indicate that the data exfiltration modules are running. The GHOSTBLADE implant, used by UNC6353 in the DarkSword campaign, leaves distinct and high-confidence log messages in iOS Unified Logs during its operation. These logs are a clear indicator of a successful compromise.
Sigma
