AMOS Stealer C2 shell/agent retrieval after registration beacon

Ibrahim Saud@tektrix

•updated 10 days ago•1•0•1

This rule detects potential command and control (C2) activity related to the AMOS (Atomic macOS) information stealer. It identifies a specific sequence of network requests where an initial registration beacon (POST /api/t) is followed by a shell agent request (GET /api/shell/agent) within 120 seconds, originating from the same destination IP and port.