Amos Stealer Artifact Cleanup

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•0•0•6

This rule detects attempts to clean up artifacts associated with the Amos Stealer by monitoring for the deletion of known staging paths. Specifically, it looks for the execution of 'rm' commands targeting '/tmp/osalogging.zip' or '/tmp/sync'. This activity suggests an adversary is trying to remove traces of their presence after data exfiltration or staging.