AMOS Stealer: Base64-Decoded curl|zsh Chain from macOS Toolkit Lure
This rule detects the multi-stage execution pattern characteristic of the AMOS stealer on macOS, where a terminal session is used to execute a base64-encoded payload piped into a shell interpreter. The rule specifically monitors for processes like curl, openssl, base64, and zsh being launched from a Terminal or shell parent, often involving specific command-line indicators or malicious URLs associated with the stealer's toolkit.
Cortex XDR
