AMOS Stealer Data Archiving via ditto

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•7

Detects the AMOS Stealer archiving collected data using the 'ditto' command with specific flags and output file names. This rule identifies the use of '-c', '-k', and '--sequesterRsrc' flags, along with '/tmp/osalogging.zip' or '/tmp/out.zip' as target archive names, which are characteristic of AMOS Stealer's data staging and archiving behavior.