AMOS Stealer: osascript Loop Checking Console Login to Launch AccountsHelper
This rule detects the use of 'osascript' on macOS to execute commands that interact with the 'AccountsHelper' process, specifically using 'stat' to probe /dev/console and 'sudo -u' for privilege elevation or user context switching. This pattern is indicative of unauthorized attempts to interact with system account management utilities or sensitive user processes.
Cortex XDR
