Skip to content

Commit d869952

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3492 from splunk/amos-stealer
Add AMOS Stealer Analytic
2 parents 8439afc + 6daa23f commit d869952

File tree

4 files changed

+104
-6
lines changed

4 files changed

+104
-6
lines changed

‎detections/endpoint/macos___re_opened_applications.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: MacOS - Re-opened Applications
22
id: 40bb64f9-f619-4e3d-8732-328d40377c4b
33
version: 5
4-
date: '2025-05-02'
4+
date: '2025-05-05'
55
author: Jamie Windley, Splunk
66
status: experimental
77
type: TTP
@@ -31,9 +31,9 @@ how_to_implement: The detection is based on data that originates from Endpoint D
3131
data model. Use the Splunk Common Information Model (CIM) to normalize the field
3232
names and speed up the data modeling process.
3333
known_false_positives: At this stage, there are no known false positives. During testing,
34-
no process events refering the com.apple.loginwindow.plist files were observed during
35-
normal operation of re-opening applications on reboot. Therefore, it can be asumed
36-
that any occurences of this in the process events would be worth investigating.
34+
no process events referring the com.apple.loginwindow.plist files were observed during
35+
normal operation of re-opening applications on reboot. Therefore, it can be assumed
36+
that any occurrences of this in the process events would be worth investigating.
3737
In the event that the legitimate modification by the system of these files is in
3838
fact logged to the process log, then the process_name of that process can be added
3939
to an allow list.

‎detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: MacOS AMOS Stealer - Virtual Machine Check Activity
2+
id: 4e41ad21-9761-426d-8aa1-083712ff9f30
3+
version: 1
4+
date: '2025-04-25'
5+
author: Nasreddine Bencherchali, Splunk, Alex Karkins
6+
status: production
7+
type: Anomaly
8+
description: |
9+
The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings. This activity is significant
10+
as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not. If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk.
11+
data_source:
12+
- osquery
13+
search: |
14+
`osquery_macro` name=es_process_events
15+
columns.cmdline="*osascript*" AND columns.cmdline="* -e *" AND columns.cmdline="*set*" AND columns.cmdline="*system_profiler*" AND columns.cmdline IN ("*VMware*", "*QEMU*")
16+
| rename columns.* as *
17+
| stats min(_time) as firstTime max(_time) as lastTime
18+
values(cmdline) as cmdline,
19+
values(pid) as pid,
20+
values(parent) as parent,
21+
values(path) as path,
22+
values(signing_id) as signing_id,
23+
by username host
24+
| rename
25+
username as user,
26+
cmdline as process,
27+
parent as parent_process,
28+
path as process_path,
29+
host as dest
30+
| `security_content_ctime(firstTime)`
31+
| `security_content_ctime(lastTime)`
32+
| `macos_amos_stealer___virtual_machine_check_activity_filter`
33+
how_to_implement: |
34+
This detection leverages osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
35+
known_false_positives: None identified.
36+
references:
37+
- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
38+
- https://www.virustotal.com/gui/search/behaviour_processes%253A%2522osascript%2520-e%2520set%2522%2520AND%2520behaviour_processes%253A%2522system_profiler%2522%2520AND%2520(behaviour_processes%253A%2522VMware%2522%2520OR%2520behaviour_processes%253A%2522QEMU%2522)?type=files
39+
drilldown_searches:
40+
- name: View the detection results for - "$user$" and "$dest$"
41+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
42+
earliest_offset: $info_min_time$
43+
latest_offset: $info_max_time$
44+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
45+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
46+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
47+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
48+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
49+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
50+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
51+
earliest_offset: $info_min_time$
52+
latest_offset: $info_max_time$
53+
rba:
54+
message: AMOS Stealer activity on host $dest$ by user $user$
55+
risk_objects:
56+
- field: user
57+
type: user
58+
score: 40
59+
- field: dest
60+
type: system
61+
score: 40
62+
threat_objects: []
63+
tags:
64+
analytic_story:
65+
- AMOS Stealer
66+
asset_type: Endpoint
67+
mitre_attack_id:
68+
- T1059.002
69+
product:
70+
- Splunk Enterprise
71+
- Splunk Enterprise Security
72+
- Splunk Cloud
73+
security_domain: endpoint
74+
tests:
75+
- name: True Positive Test
76+
attack_data:
77+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/amos_stealer/amos_stealer.log
78+
source: osquery
79+
sourcetype: osquery:results

‎detections/endpoint/macos_lolbin.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: MacOS LOLbin
22
id: 58d270fb-5b39-418e-a855-4b8ac046805e
33
version: 7
4-
date: '2025-05-02'
4+
date: '2025-05-05'
55
author: Patrick Bareiss, Splunk
66
status: production
77
type: TTP
@@ -13,7 +13,8 @@ description: The following analytic detects multiple executions of Living off th
1313
detection. If confirmed malicious, this behavior could allow attackers to execute
1414
arbitrary code, escalate privileges, or persist within the environment, posing a
1515
significant security risk.
16-
data_source: []
16+
data_source:
17+
- osquery
1718
search: '`osquery_macro` name=es_process_events columns.cmdline IN ("find*", "crontab*",
1819
"screencapture*", "openssl*", "curl*", "wget*", "killall*", "funzip*") | rename
1920
columns.* as * | stats min(_time) as firstTime max(_time) as lastTime values(cmdline)

‎stories/amos_stealer.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: AMOS Stealer
2+
id: b12e5c84-75a0-3a79-9403-e35c9fe3485c
3+
version: 1
4+
date: '2025-05-05'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
description: The AMOS Stealer analytic story provides detection and investigation content for identifying and responding to threats associated with the AMOS information stealer on Mac systems. AMOS (Atomic macOS Stealer) is a known malware family designed specifically for MacOS, capable of stealing credentials, system information, and browser data. This story leverages analytics using osquery data to detect suspicious behavior consistent with AMOS, including VM detection commands used to evade analysis environments. Security teams can use the searches in this story to identify and respond to signs of AMOS compromise in their MacOS fleet.
8+
narrative: AMOS Stealer (Atomic macOS Stealer) is an active threat targeting macOS users, capable of harvesting sensitive data, executing scripts, and conducting system reconnaissance to evade detection. It is typically distributed through malicious downloads or phishing campaigns. Once executed, AMOS performs a variety of checks to determine whether it is running in a virtualized environment before proceeding with its payload. One notable technique involves using `osascript` with AppleScript commands to enumerate virtualization indicators like VMware and QEMU. This analytic story focuses on detecting these early-stage behaviors using `osquery` data. Detecting AMOS behavior early in its execution phase gives defenders the opportunity to isolate affected hosts, investigate lateral movement or privilege escalation attempts, and mitigate data exfiltration risk.
9+
references:
10+
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos
11+
tags:
12+
category:
13+
- Malware
14+
product:
15+
- Splunk Enterprise
16+
- Splunk Enterprise Security
17+
- Splunk Cloud
18+
usecase: Advanced Threat Detection

0 commit comments

Comments
 (0)