Malicious LaunchAgent plist masquerading as com.apple.accountsd.helper
This rule detects persistence mechanisms associated with the AMOS (Atomic macOS) infostealer by monitoring for the creation of malicious LaunchAgent plist files or specific directory structures masquerading as 'com.apple.accountsd.helper'. It triggers on file events within specific hidden directories ('/Library/Application Support/.com.apple.accountsd/') or process execution events involving command lines that include both the 'com.apple.accountsd.helper' string and persistence flags such as 'RunAtLoad' or 'KeepAlive', which are indicative of a system-level process masquerade designed to maintain unauthorized access.
Microsoft Sentinel (KQL)
