Hidden .com.apple.accountsd directory nesting AccountsHelper under Application Support
This rule detects the creation of suspicious, hidden file structures within the user's 'Library/Application Support' directory on macOS, specifically targeting the directory name '.com.apple.accountsd'. It monitors for the placement of a file named 'AccountsHelper' or the creation of subdirectories commonly associated with the AMOS stealer malware (e.g., 'auth', 'cfg_cache', 'session', '.service'). The detection identifies potential evasion techniques where malware masquerades as legitimate Apple system components to persist or hide malicious activities from users.
Microsoft Sentinel (KQL)
