AMOS Stealer FileGrabber Credential/Wallet Staging Directory Creation
Detects file creation, modification, or rename activity targeting known directory paths and files used by the AMOS (Atomic macOS Stealer) to stage exfiltrated credentials, cryptocurrency wallets, and browser data. It identifies staging activity by looking for patterns associated with the stealer's data-collection routines.
Cortex XDR
