Jamf Protect Threat Prevention Changelog

Atomicsteal

Generic

Jailbreak

Limerain

Miner

Multiverze

Overlord

Revproxy

Genericobfuscatedscript

Macsyncstealer

Generic

Jailbreak

Limerain

Miner

Generic

Gost

Revproxy

Genericstealer

Atomicsteal

Generic

Maltiverza

Nukesped

Rule: OsascriptStagingViaDitto

• Version: 1

• Description: Suspicious use of Ditto through AppleScript for potential data staging

• Engine Type: AdversaryTactics

Rule: CryptocurrencyWalletAccessCommandLine

• Version: 3

• Description: Command-line access to cryptocurrency wallet or browser wallet storage

• Engine Type: AdversaryTactics

Rule: CursorCommandExecution

• Version: 1

• Description: Cursor executed a command

• Engine Type: AiVisibility

Rule: OsascriptGenericStealer

• Version: 12

• Description: Generic macOS infostealer activity detected via AppleScript execution

Cve-2022-46689

Generic

Puagent

Rule: DisguisedAppleScriptExecution

• Version: 2

• Description: AppleScript using benign file extensions or misleading filenames

• Engine Type: MalwareRiskware

Rule: OsascriptStealerBackdoor

• Version: 4

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: OsascriptStealerBackdoor

• Version: 5

• Description: Advanced Threat Controls (ATC) – Persistent macOS Infostealer Backdoor

Atomicsteal

Generic

Gost

Jailbreak

Limerain

Nukesped

Rule: XProtectMalwareRemediated

• Version: 1

• Description: XProtect malware remediation event detected

• Engine Type: MalwareRiskware

Rule: CryptocurrencyWalletAccessCommandLine

• Version: 2

• Description: Command-line access to cryptocurrency wallet or browser wallet storage

• Engine Type: AdversaryTactics

Pamstealer

Wel1dropper

Generic

Amnesiastealer

Rule: SuspiciousCurlFlagUsage

• Version: 4

• Description: Curl executed with suspicious flag combinations

• Engine Type: AdversaryTactics

Rule: StealerDataExfiltration

• Version: 12

• Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Rule: KnownMaliciousCurlCommand

• Version: 4

• Description: Curl executed in a known malicious manner

• Engine Type: FilelessThreats

Rule: CurlStealerDownloader

• Version: 8

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Rule: CurlBasedDeadDropResolver

• Version: 2

• Description: Curl used to retrieve command or configuration data from legitimate web services

• Engine Type: AdversaryTactics

Rule: CurlStealerDownloader

• Version: 33

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: SuspiciousCurlFlagUsage

• Version: 5

• Description: Curl executed with suspicious flag combinations

Generic

Multiverze

Rule: CurlStealerDownloader

• Version: 33

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Amnesiastealer

Rule: CurlStealerDownloader

• Version: 33

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: CurlStealerDownloader

• Version: 8

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Generictrojan

Atomicsteal

Cve-2022-46689

Generic

Multiverze

Overlord

Revproxy

Genericstealer

Rule: DisguisedAppleScriptExecution

• Version: 1

• Description: AppleScript using benign file extensions or misleading filenames

• Engine Type: MalwareRiskware

Shaihulud

Rule: InMemoryOsascriptToJavascript

• Version: 2

• Description: In-Memory JavaScript Execution via osascript

• Engine Type: AdversaryTactics

Rule: SuspiciousZipCreatedInPrivateTmp

• Version: 9

• Description: Suspicious ZIP archive created in temporary directory

• Engine Type: MalwareRiskware

Rule: FindCredentialAndWalletFileEnumeration

• Version: 2

• Description: Enumeration of credential and cryptocurrency wallet files via find

• Engine Type: AdversaryTactics

Rule: TelegramBotMessageSentFromScriptEditor

• Version: 2

• Description: Script Editor sent data through the Telegram Bot API

• Engine Type: AdversaryTactics

Rule: OsascriptGenericStealer

• Version: 8

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: OsascriptGenericStealer

• Version: 11

• Description: Generic macOS infostealer activity detected via AppleScript execution

Atomicsteal

Generic

Multiverze

Rule: FindCredentialAndWalletFileEnumeration

• Version: 1

• Description: Enumeration of credential and cryptocurrency wallet files via find

• Engine Type: AdversaryTactics

Generichacktool

Atomicsteal

Generic

Revproxy

Vortex

Dprk

Generictrojan

Atomicsteal

Bitcoinminer

Generic

Jailbreak

Dprk

Rule: KnownMaliciousCurlCommand

• Version: 3

• Description: Curl executed in a known malicious manner

• Engine Type: FilelessThreats

Rule: KnownMaliciousCurlCommand

• Version: 8

• Description: Advanced Threat Controls (ATC) - Known Malicious curl Command Execution

Rule: SuspiciousZipCreatedInPrivateTmp

• Version: 8

• Description: Suspicious ZIP archive created in temporary directory

• Engine Type: MalwareRiskware

Atomicsteal

Generic

Multiverze

Cyberstrike

Genericobfuscatedscript

Gsnetcat

Beavertail

Genericransomwarepoc

Generic

Limerain

Rule: KnownMalwarePathFileCreation

• Version: 6

• Description: File created at a location associated with known malicious activity

• Engine Type: AdversaryTactics

Rule: InMemoryOsascriptToJavascript

• Version: 1

• Description: In-Memory JavaScript Execution via osascript

• Engine Type: AdversaryTactics

Rule: OsascriptStealerBackdoor

• Version: 3

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: OsascriptStealerBackdoor

• Version: 4

• Description: Advanced Threat Controls (ATC) – Persistent macOS Infostealer Backdoor

Generictrojan

Macsyncstealer

Rule: KnownMaliciousCurlCommand

• Version: 7

• Description: Advanced Threat Controls (ATC) - Known Malicious curl Command Execution

Rule: KnownMaliciousCurlCommand

• Version: 2

• Description: Curl executed in a known malicious manner

• Engine Type: FilelessThreats

Rule: M365CopilotLaunch

• Version: 1

• Description: Microsoft 365 Copilot desktop app launched

• Engine Type: AiVisibility

Rule: ClawpilotCommandExecution

• Version: 1

• Description: Clawpilot executed a command

• Engine Type: AiVisibility

Rule: ClawpilotLaunch

• Version: 1

• Description: Clawpilot desktop app launched

• Engine Type: AiVisibility

Dprk

Gaslight

Generic

Limerain

Gaslight

Generic

Nukesped

Overlord

Pasivrobber

Puagent

Gaslight

Dprk

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 10

• Description: Known malicious commands executed through VSCode tasks for payload delivery

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 4

• Description: VSCode executed a known malicious command

• Engine Type: MalwareRiskware

Genericdownloader

Rule: SuspiciousZipCreatedInPrivateTmp

• Version: 7

• Description: Suspicious ZIP archive created in temporary directory

• Engine Type: MalwareRiskware

Overlord

Atomicsteal

Generic

Limerain

Multiverze

Rule: ExecutionInSharedDirectory

• Version: 2

• Description: Execution in Shared Directory

Rule: ExecutionInSharedDirectory

• Version: 2

• Description: Program executed in Shared Directory

• Engine Type: AdversaryTactics

Odyssey

Generic

Spyagent

Flexibleferret

Rule: DockTileAdded

• Version: 3

• Description: New Dock Tile registered

Generic

Gost

Multiverze

Revproxy

Hackbrowserdata

Supplychain

Polinrider

Overlord

Rule: TelegramBotMessageSentFromScriptEditor

• Version: 1

• Description: Script Editor sent data through the Telegram Bot API

• Engine Type: AdversaryTactics

Rule: DiskImageMountedContainingRiskwareIndicators

• Version: 1

• Description: Disk image containing indicators of riskware or pirated software

• Engine Type: AdversaryTactics

Rule: CurlStealerDownloader

• Version: 32

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Atomicsteal

Cve-2022-46689

Generic

Rule: XcodeExecutesCurl

• Version: 3

• Description: Suspicious curl command executed during Xcode build process

• Engine Type: AdversaryTactics

Rule: XcodeExecutesCurl

• Version: 7

• Description: Suspicious curl command executed during Xcode build process

Rule: ProcessDisguisedAsApple

• Version: 2

• Description: Process created with common macOS service name

• Engine Type: AdversaryTactics

Generictrojan

Clicklockstealer

Generic

Maltiverza

Spyagent

Generictrojan

Dprk

Rule: OsascriptGenericStealer

• Version: 7

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: SuspiciousZipCreatedInPrivateTmp

• Version: 6

• Description: Suspicious ZIP archive created in temporary directory

• Engine Type: MalwareRiskware

Rule: StealerDataExfiltration

• Version: 5

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: OsascriptGenericStealer

• Version: 10

• Description: Generic macOS infostealer activity detected via AppleScript execution

Rule: StealerDataExfiltration

• Version: 11

• Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Dprk

Rule: ProcessDisguisedAsApple

• Version: 19

• Description: Process created with common Apple service name

Flexibleferret

Generic

Genericstealer

Multiverze

Sliver

Atomic

Genericstealer

Xcsset

Rule: XcodeExecutesCurl

• Version: 6

• Description: Suspicious curl command executed during Xcode build process

Rule: XcodeExecutesCurl

• Version: 2

• Description: Suspicious curl command executed during Xcode build process

• Engine Type: AdversaryTactics

Crashstealer

Generic

Multiverze

Rload

Genericstealer

Genericdownloader

Rule: SuspiciousDiskImageMounted

• Version: 1

• Description: Disk Image mounted containing suspicious instructions

• Engine Type: AdversaryTactics

Miasma

Rule: TamperKillSignalAttempt

• Version: 2

• Description: Tamper Prevention - Kill Signal

• Engine Type: SystemTampering

Generic

Jailbreak

Vortex

Beavertail

Ironworm

Atomicsteal

Generic

Miner

Atomicsteal

Generic

Maltiverza

Multiverze

Nukesped

Atomic

Rule: SuspiciousPbpasteInvocation

• Version: 1

• Description: Suspicious invocation of pbpaste

• Engine Type: AdversaryTactics

Rule: ShellDownloadsMountsAndExecutesDiskImage

• Version: 1

• Description: Shell downloaded and mounted and executed content from a disk image

• Engine Type: AdversaryTactics

Rule: AdhocCodeSigningWithCodesign

• Version: 4

• Description: Ad-hoc code signing of an executable detected

• Engine Type: AdversaryTactics

Rule: InstalledApplicationEnumerationViaDiskUsage

• Version: 1

• Description: Installed application disk usage enumeration detected

• Engine Type: AdversaryTactics

Rule: CodesignInvokedFromScriptEditor

• Version: 1

• Description: Codesign invoked from Script Editor

• Engine Type: AdversaryTactics

Rule: LoginKeychainUnlockViaShell

• Version: 1

• Description: Login Keychain unlocked via shell

• Engine Type: AdversaryTactics

Atomicsteal

Generic

Multiverze

Revproxy

Rule: SuspiciousLaunchItemExecutablePath

• Version: 2

• Description: Launch item created with suspicious executable path

• Engine Type: AdversaryTactics

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 3

• Description: VSCode executed a known malicious command

• Engine Type: MalwareRiskware

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 9

• Description: Known malicious commands executed through VSCode tasks for payload delivery

Rule: CurlStealerDownloader

• Version: 7

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Rule: CurlStealerDownloader

• Version: 31

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Generic

Multiverze

Rule: CurlStealerDownloader

• Version: 30

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: CurlStealerDownloader

• Version: 6

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Crashstealer

Genericstealer

Rule: SuspiciousZipCreatedInPrivateTmp

• Version: 5

• Description: Suspicious ZIP archive created in temporary directory

• Engine Type: MalwareRiskware

Rule: AdhocCodeSigningWithCodesign

• Version: 3

• Description: Ad-hoc code signing of an executable detected

• Engine Type: AdversaryTactics

Rule: SuspiciousCurlFlagUsage

• Version: 4

• Description: Curl executed with suspicious flag combinations

Rule: SuspiciousCurlFlagUsage

• Version: 3

• Description: Curl executed with suspicious flag combinations

• Engine Type: AdversaryTactics

Rule: SuspiciousDiskImageMounted

• Version: 1.0

• Description: Disk Image mounted containing suspicious instructions

• Engine Type: AdversaryTactics

Pamstealer

Bitcoinminer

Generic

Multiverze

Spyagent

Genericstealer

Rule: KnownMaliciousCurlCommand

• Version: 1

• Description: Curl executed in a known malicious manner

• Engine Type: FilelessThreats

Rule: KnownInfostealerArtifactsPathFileCreation

• Version: 3

• Description: File created at a location associated with known infostealer artifacts

• Engine Type: AdversaryTactics

Rule: KnownMalwarePathFileCreation

• Version: 6

• Description: File created at a location associated with known malicious activity

• Engine Type: AdversaryTactics

Rule: StealerDataExfiltration

• Version: 4

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: OsascriptAntiVM

• Version: 1

• Description: AppleScript performed anti-debugging

• Engine Type: AdversaryTactics

Rule: SuspiciousDiskImageMounted

• Version: 1.0

• Description: Disk Image mounted containing suspicious instructions

• Engine Type: Experimental

Rule: OsascriptStealerBackdoor

• Version: 2

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: OsascriptGenericStealer

• Version: 6

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 2

• Description: VSCode executed a known malicious command

• Engine Type: MalwareRiskware

Generic

Jailbreak

Multiverze

Generic

Jailbreak

Multiverze

Dprk

Overlord

Atomicsteal

Dprk

Generic

Maltiverza

Multiverze

Puagent

Generic

Pamstealer

Bansheestealer

Rule: LoginItemDeprecated

• Version: 2

• Description: LoginItem created for persistence

Rule: LoginItemDepreciated

• Version: 2

• Description: LoginItem created for persistence

Rule: GeminiDesktopCommandExecution

• Version: 1

• Description: Gemini Desktop executed a command

• Engine Type: AiVisibility

Rule: KiroCLICommandExecution

• Version: 1

• Description: Kiro CLI executed a command

• Engine Type: AiVisibility

Rule: ZedLaunch

• Version: 1

• Description: Zed AI code editor launched

• Engine Type: AiVisibility

Rule: DevinLaunch

• Version: 1

• Description: Devin AI IDE launched

• Engine Type: AiVisibility

Rule: AntigravityLaunch

• Version: 1

• Description: Antigravity app launched

• Engine Type: AiVisibility

Rule: CursorLaunch

• Version: 1

• Description: Cursor AI IDE launched

• Engine Type: AiVisibility

Rule: OMLXAppLaunch

• Version: 1

• Description: oMLX app launched

• Engine Type: AiVisibility

Rule: CopilotCLILaunch

• Version: 1

• Description: GitHub Copilot CLI launched

• Engine Type: AiVisibility

Rule: LlamaCppServerLaunch

• Version: 1

• Description: llama.cpp inference server or llamafile launched

• Engine Type: AiVisibility

Rule: AntigravityCommandExecution

• Version: 1

• Description: Antigravity executed a command

• Engine Type: AiVisibility

Rule: MistralVibeLaunch

• Version: 1

• Description: Mistral Vibe AI coding assistant launched

• Engine Type: AiVisibility

Rule: ChatGPTAppLaunch

• Version: 1

• Description: ChatGPT desktop app launched

• Engine Type: AiVisibility

Rule: LMStudioLaunch

• Version: 1

• Description: LM Studio local model app launched

• Engine Type: AiVisibility

Rule: AiderCLICommandExecution

• Version: 1

• Description: Aider CLI executed a command

• Engine Type: AiVisibility

Rule: ClaudeDesktopLaunch

• Version: 1

• Description: Claude desktop app launched

• Engine Type: AiVisibility

Rule: GeminiCLILaunch

• Version: 1

• Description: Gemini CLI launched

• Engine Type: AiVisibility

Rule: OpencodeCLILaunch

• Version: 1

• Description: Opencode CLI launched

• Engine Type: AiVisibility

Rule: ClaudeCodeLaunch

• Version: 1

• Description: Claude Code process launched on this endpoint

• Engine Type: AiVisibility

Rule: AntigravityIDELaunch

• Version: 1

• Description: Antigravity IDE app launched

• Engine Type: AiVisibility

Rule: GeminiDesktopLaunch

• Version: 1

• Description: Gemini desktop app launched

• Engine Type: AiVisibility

Rule: MistralVibeCommandExecution

• Version: 1

• Description: Mistral Vibe executed a command

• Engine Type: AiVisibility

Rule: CopilotCLICommandExecution

• Version: 1

• Description: GitHub Copilot CLI executed a command

• Engine Type: AiVisibility

Rule: KiroCLILaunch

• Version: 1

• Description: Kiro CLI launched

• Engine Type: AiVisibility

Rule: ChatGPTCommandExecution

• Version: 1

• Description: ChatGPT executed a command

• Engine Type: AiVisibility

Rule: PiCLICommandExecution

• Version: 1

• Description: Pi CLI executed a command

• Engine Type: AiVisibility

Rule: FMCommandExecution

• Version: 1

• Description: Apple FM executed a command

• Engine Type: AiVisibility

Rule: CursorCommandExecution

• Version: 1

• Description: Cursor executed a command

• Engine Type: AiVisibility

Rule: OpencodeCLICommandExecution

• Version: 1

• Description: Opencode CLI executed a command

• Engine Type: AiVisibility

Rule: ClaudeCodeCommandExecution

• Version: 1

• Description: Claude Code executed a command

• Engine Type: AiVisibility

Rule: AiderCLILaunch

• Version: 1

• Description: Aider AI coding assistant launched

• Engine Type: AiVisibility

Rule: KiroDesktopLaunch

• Version: 1

• Description: Kiro AI IDE launched

• Engine Type: AiVisibility

Rule: CodexCLILaunch

• Version: 1

• Description: Codex CLI launched

• Engine Type: AiVisibility

Rule: FMLaunch

• Version: 1

• Description: Apple FM app launched

• Engine Type: AiVisibility

Rule: AIAppSpawnsSuspiciousProcess

• Version: 1

• Description: AI app spawned a high-risk process

• Engine Type: AiVisibility

Rule: CodexDesktopLaunch

• Version: 1

• Description: Codex desktop app launched

• Engine Type: AiVisibility

Rule: CodexCLICommandExecution

• Version: 1

• Description: Codex CLI executed a command

• Engine Type: AiVisibility

Rule: ClaudeDesktopCommandExecution

• Version: 1

• Description: Claude Desktop executed a command

• Engine Type: AiVisibility

Rule: GeminiCLICommandExecution

• Version: 1

• Description: Gemini CLI executed a command

• Engine Type: AiVisibility

Rule: VSCodeLaunch

• Version: 1

• Description: Visual Studio Code launched

• Engine Type: AiVisibility

Rule: PiCLILaunch

• Version: 1

• Description: Pi CLI launched

• Engine Type: AiVisibility

Rule: OpenCodeDesktopCommandExecution

• Version: 1

• Description: OpenCode Desktop executed a command

• Engine Type: AiVisibility

Rule: CodexDesktopCommandExecution

• Version: 1

• Description: Codex executed a command

• Engine Type: AiVisibility

Rule: OpenCodeDesktopLaunch

• Version: 1

• Description: OpenCode desktop app launched

• Engine Type: AiVisibility

Adaptixc2

Atomicsteal

Dprk

Generic

Genericstealer

Jailbreak

Multiverze

Generictrojan

Polinrider

Atomic

Rule: OsascriptStealerBackdoor

• Version: 3

• Description: Advanced Threat Controls (ATC) – Persistent macOS Infostealer Backdoor

Rule: OsascriptStealerBackdoor

• Version: 2

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: KnownInfostealerArtifactsPathFileCreation

• Version: 2

• Description: File created at a location associated with known infostealer artifacts

• Engine Type: AdversaryTactics

Atomicsteal

Dprk

Generic

Multiverze

Genericstealer

Generic

Tuneupmymac

Adaptixc2

Dprk

Dprk

Dprk

Generic

Jailbreak

Multiverze

Supplychain

Generic

Multiverze

Revproxy

Shaihulud

Genericstealer

Dprk

Rule: MaliciousCurlUserAgent

• Version: 2

• Description: Curl used a known malicious user agent

• Engine Type: FilelessThreats

Rule: MaliciousCurlUserAgent

• Version: 4

• Description: Advanced Threat Controls (ATC) - Malicious Curl User Agent

Atomicsteal

Cve-2022-46689

Generic

Jailbreak

Multiverze

Xcodeghost

Genericstealer

Dprk

Cve-2022-46689

Generic

Generic

Miner

Multiverze

Puagent

Generic

Supplychain

Atomicsteal

Generic

Jailbreak

Cobaltstrikebeacon

Generic

Jailbreak

Multiverze

Puagent

Generic

Jailbreak

Miner

Revproxy

Rule: HiddenScriptRunFromVolumes

• Version: 11

• Description: Hidden script execution

Genericstealer

Generic

Genericstealer

Multiverze

Supplychain

Generic

Miner

Shaihulud

Rule: SuspiciousCurlFlagUsage

• Version: 3

• Description: Curl executed with suspicious flag combinations

Rule: SuspiciousCurlFlagUsage

• Version: 2

• Description: Curl executed with suspicious flag combinations

• Engine Type: AdversaryTactics

Atomicsteal

Generic

Jailbreak

Maltiverza

Shaihulud

Generic

Multiverze

Rule: SelfDelete

• Version: 2

• Description: A process deleted its own binary

Supplychain

Generic

Generictrojan

Generic

Rule: StealerDataExfiltration

• Version: 4

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: SuspiciousZipCreatedInPrivateTmp

• Version: 4

• Description: Suspicious ZIP archive created in temporary directory

• Engine Type: MalwareRiskware

Rule: StealerDataExfiltration

• Version: 10

• Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Dazzlespy

Generic

Cobaltstrikebeacon

Generic

Miner

Multiverze

Supplychain

Fluttershell

Atomicsteal

Bitcoinminer

Cobaltstrikebeacon

Generic

Gost

Miner

Multiverze

Fluttershell

Shaihulud

Atomicsteal

Generic

Jailbreak

Maltiverza

Multiverze

Poseidon

Rule: CurlStealerDownloader

• Version: 29

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: CurlStealerDownloader

• Version: 5

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Genericobfuscatedscript

Adagent

Cobaltstrikebeacon

Generic

Maltiverza

Multiverze

Puagent

Rule: SSHServiceEnabledViaCmd

• Version: 4

• Description: SSH Enabled

• Engine Type: FilelessThreats

Atomicsteal

Generic

Multiverze

Odysseysteal

Poseidonstealer

Vigorf

Dprk

Generictrojan

Asyncwake

Generic

Multiverze

Poseidon

Atomic

Rule: KnownMalwarePathFileCreation

• Version: 5

• Description: File created at a location associated with known malicious activity

• Engine Type: AdversaryTactics

Genericstealer

Rule: DsclCredentialValidation

• Version: 3

• Description: Local credential validation using dscl detected

• Engine Type: AdversaryTactics

Rule: SuspiciousZipCreatedInPrivateTmp

• Version: 3

• Description: Suspicious ZIP archive created in temporary directory

• Engine Type: MalwareRiskware

Rule: StealerDataExfiltration

• Version: 9

• Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Rule: DsclCredentialValidation

• Version: 3

• Description: Local credential validation using dscl detected

Rule: StealerDataExfiltration

• Version: 3

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Genericstealer

Rule: OsascriptGenericStealer

• Version: 9

• Description: Generic macOS infostealer activity detected via AppleScript execution

Rule: ManualExecutionFromTerminal

• Version: 3

• Description: Advanced Threat Controls (ATC) - Manual Execution from Terminal

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 8

• Description: Known malicious commands executed through VSCode tasks for payload delivery

Rule: KnownMaliciousCurlCommand

• Version: 1

• Description: Curl executed in a known malicious manner

• Engine Type: FilelessThreats

Rule: InsecureCurlFromScriptEditor

• Version: 3

• Description: Advanced Threat Controls (ATC) - Insecure Curl Execution from Script Editor

Rule: MaliciousBehaviorFromNodeProcess

• Version: 1

• Description: Malicious Behavior from Node process

• Engine Type: MalwareRiskware

Rule: ManualExecutionFromTerminal

• Version: 1

• Description: Common attacker technique observed within Terminal.app

• Engine Type: AdversaryTactics

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 2

• Description: VSCode executed a known malicious command

• Engine Type: MalwareRiskware

Rule: KnownMaliciousCurlCommand

• Version: 6

• Description: Advanced Threat Controls (ATC) - Known Malicious curl Command Execution

Rule: MaliciousBehaviorFromNodeProcess

• Version: 7

• Description: Suspicious shell or script execution originating from a Node.js process

Rule: OsascriptGenericStealer

• Version: 5

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: CurlStealerDownloader

• Version: 4

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Rule: InsecureCurlFromScriptEditor

• Version: 1

• Description: Curl executed in a known malicious manner

• Engine Type: FilelessThreats

Rule: CurlStealerDownloader

• Version: 28

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: DisguisedAppleScriptExtension

• Version: 3

• Description: AppleScript execution detected where the script masquerades using benign file extensions or misleading filenames

Rule: DisguisedAppleScriptExtension

• Version: 1

• Description: AppleScript using benign file extensions or misleading filenames

• Engine Type: MalwareRiskware

Rule: MaliciousBehaviorFromNode

• Version: 4

• Description: Suspicious curl command piped to shell executed by a Node.js parent process

Invisibleferret

Atomicsteal

Generic

Poseidon

Supplychain

Atomicsteal

Generic

Rule: CurlStealerDownloader

• Version: 28

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: CurlStealerDownloader

• Version: 4

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Supplychain

Atomicsteal

Dprk

Generic

Metasploit

Multiverze

Spyagent

Rule: SudoAuthorizationFileCloseModified

• Version: 4

• Description: Modification of sudo privilege configuration or authentication files

• Engine Type: AdversaryTactics

Generic

Jailbreak

Maltiverza

Multiverze

Revproxy

Sliver

Supplychain

Rule: TamperSetflagsPrevent

• Version: 2

• Description: Tamper Prevention

• Engine Type: SystemTampering

Rule: TamperSetflagsAttempt

• Version: 2

• Description: Tamper Prevention

• Engine Type: SystemTampering

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 2

• Description: VSCode executed a known malicious command

• Engine Type: MalwareRiskware

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 7

• Description: Known malicious commands executed through VSCode tasks for payload delivery

Dprk

Supplychain

Rule: TamperUnsignedSignalAttempt

• Version: 1

• Description: Tamper Prevention - Unsigned Signal Attempt

• Engine Type: SystemTampering

Atomicsteal

Cobaltstrikebeacon

Generic

Multiverze

Supplychain

Genericstealer

Odyssey

Rule: AppleScriptPromptsForCredentials

• Version: 2

• Description: AppleScript dialog for collection of secrets

• Engine Type: AdversaryTactics

Atomicsteal

Cobaltstrikebeacon

Generic

Multiverze

Supplychain

Atomicsteal

Generic

Macbooster

Multiverze

Puagent

Rule: NpmMaliciousPackage

• Version: 8

• Description: Execution of potentially malicious NPM package, indicating suspicious script activity during install or runtime

Rule: NpmMaliciousPackage

• Version: 3

• Description: Execution of potentially malicious NPM package

• Engine Type: Experimental

Atomicsteal

Generic

Jailbreak

Miner

Multiverze

Xcsset

Rule: CurlStealerDownloader

• Version: 3

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Rule: CurlStealerDownloader

• Version: 27

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Bansheestealer

Rule: QuarantineAttributeRemovedFromUnusualPath

• Version: 4

• Description: Quarantine attribute removed from a file

• Engine Type: AdversaryTactics

Rule: KnownInfostealerArtifactsPathFileCreation

• Version: 1

• Description: File created at a location associated with known infostealer artifacts

• Engine Type: AdversaryTactics

Rule: KnownMalwarePathFileCreation

• Version: 4

• Description: File created at a location associated with known malicious activity

• Engine Type: AdversaryTactics

Rule: SSHServiceEnabledViaCmd

• Version: 3

• Description: SSH Enabled

• Engine Type: FilelessThreats

Generic

Multiverze

Rule: SSHServiceEnabledViaCmd

• Version: 2

• Description: SSH Enabled

• Engine Type: FilelessThreats

Rule: SudoAuthorizationFileOpen

• Version: 2

• Description: Access to sudo privilege configuration or authentication files

• Engine Type: AdversaryTactics

Rule: DatabaseFileCloseModified

• Version: 2

• Description: Database file modified in a user home directory.

• Engine Type: AdversaryTactics

Rule: SpotlightImporterCreated

• Version: 2

• Description: Creation of a Spotlight importer plugin detected

• Engine Type: AdversaryTactics

Rule: SuspiciousCurlCommand

• Version: 1

• Description: Remote script passed directly to memory

• Engine Type: FilelessThreats

Rule: SudoAuthorizationFileOpen

• Version: 2

• Description: Access to sudo privilege configuration or authentication files

• Engine Type: AdversaryTactics

Supplychain

Supplychain

Genericdownloader

Rule: PackagedPythonExecutableLaunched

• Version: 1

• Description: Packaged Python executable was launched

• Engine Type: AdversaryTactics

Rule: CurlStealerDownloader

• Version: 2

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Rule: InlinePayloadDecompression

• Version: 2

• Description: Suspicious use of gunzip or bunzip2 for inline payload decompression detected

• Engine Type: AdversaryTactics

Rule: AdhocCodeSigningWithCodesign

• Version: 2

• Description: Ad-hoc code signing of an executable detected

• Engine Type: AdversaryTactics

Atomicsteal

Generic

Jailbreak

Miner

Multiverze

Revproxy

Rule: OsascriptGenericStealer

• Version: 8

• Description: Generic macOS infostealer activity detected via AppleScript execution

Rule: OsascriptGenericStealer

• Version: 5

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: CurlStealerDownloader

• Version: 26

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: CurlStealerDownloader

• Version: 2

• Description: A curl command was run commonly used within InfoStealers

• Engine Type: MalwareRiskware

Rule: AdhocCodeSigningWithCodesign

• Version: 2

• Description: Ad-hoc code signing of an executable detected

• Engine Type: AdversaryTactics

Rule: DylibLoadedFromSuspiciousPath

• Version: 3

• Description: Dylib loaded from a suspicious or non-standard path

• Engine Type: AdversaryTactics

Digitstealer

Atomicsteal

Generic

Multiverze

Rule: DylibLoadedFromSuspiciousPath

• Version: 2

• Description: Dylib loaded from a suspicious or non-standard path

• Engine Type: AdversaryTactics

Atomicsteal

Generic

Multiverze

Rule: StealerDataExfiltration

• Version: 2

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Rule: SuspiciousZipCreatedInPrivateTmp

• Version: 2

• Description: Suspicious ZIP archive created in temporary directory

• Engine Type: MalwareRiskware

Rule: StealerDataExfiltration

• Version: 8

• Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Rule: KnownMalwarePathFileCreation

• Version: 3

• Description: File created at a location associated with known malicious activity

• Engine Type: AdversaryTactics

Genericstealer

Rule: NpmMaliciousPackage

• Version: 8

• Description: Execution of potentially malicious NPM package, indicating suspicious script activity during install or runtime

Cve-2016-5195

Cve-2022-46689

Generic

Miner

Multiverze

Rule: TamperUnsignedSignalAttempt

• Version: 0

• Description: Tamper Prevention - Unsigned Signal Attempt

• Engine Type: SystemTampering

Rule: DylibLoadedFromSuspiciousPath

• Version: 1

• Description: Dylib loaded from a suspicious or non-standard path

• Engine Type: AdversaryTactics

Rule: KnownMalwarePathFileCreation

• Version: 2

• Description: File created at a location associated with known malicious activity

• Engine Type: AdversaryTactics

Digitstealer

Rule: OsascriptGenericStealer

• Version: 7

• Description: Generic macOS infostealer activity detected via AppleScript execution

Rule: OsascriptGenericStealer

• Version: 4

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Pyspy

Atomicsteal

Generic

Multiverze

Rule: NpmMaliciousPackage

• Version: 7

• Description: Execution of potentially malicious NPM package, indicating suspicious script activity during install or runtime

Adload

Atomicsteal

Generic

Miner

Multiverze

Bearhug

Rule: OsascriptGenericStealer

• Version: 6

• Description: Generic macOS infostealer activity detected via AppleScript execution

Rule: OsascriptGenericStealer

• Version: 3

• Description: Known malicious infostealer activity

• Engine Type: MalwareRiskware

Supplychain

Rule: SudoAuthorizationFileCloseModified

• Version: 3

• Description: Modification of sudo privilege configuration or authentication files

• Engine Type: AdversaryTactics

Genericdownloader

Rule: ProcessMasqueradingAsApple

• Version: 1

• Description: Non-platform binary masquerading as an Apple process

• Engine Type: AdversaryTactics

Rule: DatabaseFileCloseModified

• Version: 1

• Description: Database file modified in a user home directory.

• Engine Type: AdversaryTactics

Rule: NpmMaliciousPackage

• Version: 2

• Description: Execution of potentially malicious NPM package

• Engine Type: MalwareRiskware

Rule: NpmMaliciousPackage

• Version: 6

• Description: Execution of potentially malicious NPM package, indicating suspicious script activity during install or runtime

Atomicsteal

Generic

Multiverze

Atomicsteal

Cve-2022-46689

Dprk

Flexibleferret

Jailbreak

Multiverze

Rule: SudoAuthorizationFileCloseModified

• Version: 2

• Description: Modification of sudo privilege configuration or authentication files

• Engine Type: AdversaryTactics

Rule: InlinePayloadDecompression

• Version: 2

• Description: Suspicious use of gunzip or bunzip2 for inline payload decompression detected

• Engine Type: AdversaryTactics

Atomicsteal

Generic

Multiverze

Dprk

Glassworm

Ottercookie

Beavertail

Rule: MaliciousCurlUserAgent

• Version: 3

• Description: Advanced Threat Controls (ATC) - Malicious Curl User Agent

Rule: MaliciousCurlUserAgent

• Version: 1

• Description: Curl used a known malicious user agent

• Engine Type: FilelessThreats

Generictrojan

Atomic

Bansheestealer

Ghostclaw

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 1

• Description: VSCode executed a known malicious command

• Engine Type: MalwareRiskware

Rule: MaliciousBehaviorFromVSCodeTasks

• Version: 6

• Description: Known malicious commands executed through VSCode tasks for payload delivery

Dprk

Genericdownloader

Generictrojan

Flexibleferret

Cobaltstrikebeacon

Generic

Installmiez

Jailbreak

Multiverze

Xcodeghost

Atomicsteal

Backtrack

Generic

Multiverze

Supplychain

Generic

Multiverze

Rload

Genericstealer

Generictrojan

Genericstealer

Atomicsteal

Generic

Multiverze

Rule: PythonBase64DownloadAndExecute

• Version: 4

• Description: Python inline execution used to fetch, decode, and execute an obfuscated payload in memory without writing to disk

Supplychain

Genericstealer

Dprk

Dprk

Generic

Multiverze

Generichacktool

Overlord

Rule: CurlStealerDownloader

• Version: 25

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Adagent

Adaptixc2

Atomicsteal

Dockmaster

Generic

Jailbreak

Ketin

Multiverze

Xcodeghost

Novastealer

Dprk

Dprk

Atomicsteal

Generic

Jailbreak

Puagent

Rule: CurlStealerDownloader

• Version: 24

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Dprk

Generic

Xcodeghost

Cve-2022-46689

Generic

Multiverze

Dprk

Atomicsteal

Cve-2021-30937

Cve-2022-46689

Dprk

Generic

Jailbreak

Multiverze

Rload

Dprk

Generic

Cve-2016-5195

Cve-2022-46689

Generic

Multiverze

Nukesped

Cve-2016-5195

Generic

Multiverze

Dprk

Rule: InsecureCurlFromScriptEditor

• Version: 2

• Description: Advanced Threat Controls (ATC) - Insecure Curl Execution from Script Editor

Rule: CurlStealerDownloader

• Version: 23

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Notnullosxstealer

Generic

Jailbreak

Multiverze

Genericdownloader

Genericstealer

Rule: MaliciousBehaviorFromNodeProcess

• Version: 6

• Description: Suspicious shell or script execution originating from a Node.js process

Glassworm

Multiverze

Atomicsteal

Generic

Jailbreak

Maltiverza

Dprk

Atomic

Rule: MaliciousBehaviorFromNodeProcess

• Version: 5

• Description: Suspicious shell or script execution originating from a Node.js process

Generic

Multiverze

Dprk

Rule: MaliciousCurlUserAgent

• Version: 2

• Description: Advanced Threat Controls (ATC) - Malicious Curl User Agent

Atomicsteal

Cve-2016-5195

Flexibleferret

Generic

Infinitistealer

Multiverze

Rload

Rustbucket

Atomic

Atomic

Rule: StealerDataExfiltration

• Version: 7

• Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Infinitistealer

Rule: CurlStealerDownloader

• Version: 22

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Atomicsteal

Generic

Jailbreak

Miner

Multiverze

Rload

Nukesped

Cobaltstrikebeacon

Cve-2022-46689

Generic

Multiverze

Nukesped

Cve-2022-46689

Generic

Multiverze

Rload

Generic

Generic

Multiverze

Rload

Nukesped

Generic

Miner

Multiverze

Dprk

Atomic

Nukesped

Cobaltstrikebeacon

Cve-2022-46689

Generic

Multiverze

Rload

Sliver

Atomic

Infinitistealer

Infinitestealer

Infinitestealer

Infinitistealer

Rule: PythonBase64DownloadAndExecute

• Version: 3

• Description: Python inline execution used to fetch, decode, and execute an obfuscated payload in memory without writing to disk

Atomicsteal

Genericobfuscatedscript

Infinitestealer

Infinitestealer

Generic

Jailbreak

Rload

Sliver

Generic

Multiverze

Rload

Rule: SuspiciousCurlFlagUsage

• Version: 2

• Description: Curl executed with suspicious flag combinations

Atomicsteal

Generic

Multiverze

Odysseysteal

Rule: PythonBase64DownloadAndExecute

• Version: 2

• Description: Python inline execution used to fetch, decode, and execute an obfuscated payload in memory without writing to disk

Rule: PythonBase64DownloadAndExecute

• Version: 1

• Description: Python inline execution used to fetch, decode, and execute an obfuscated payload in memory without writing to disk

Rule: StealerDataExfiltration

• Version: 6

• Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Adagent

Generic

Multiverze

Rload

Genericobfuscatedscript

Rule: CustomURLHandlerCreation

• Version: 3

• Description: Application that uses custom url handler created

Rule: DsclCredentialValidation

• Version: 2

• Description: Local credential validation using dscl detected

Rule: DsclCredentialValidation

• Version: 1

• Description: Local credential validation using dscl detected

Flexibleferret

Rule: SuspiciousCurlFlagUsage

• Version: 1

• Description: Curl executed with suspicious flag combinations

Genericstealer

Rule: SuspiciousCurlFlagUsage

• Version: 1

• Description: Curl executed with suspicious flag combinations

Generic

Maccontrol

Multiverze

Notnullosxstealer

Atomic

Cobaltstrikebeacon

Fscan

Generic

Multiverze

Generic

Multiverze

Generic

Multiverze

Flexibleferret

Ghostclaw

Adagent

Rule: CurlStealerDownloader

• Version: 21

• Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Ghostclaw

Soalara

Powerhouse

Atomicsteal

Generic

Jailbreak

Macsyncstealer

Multiverze

Rload

Lazagne

Rule: CurlStealerDownloader

Version: 20

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: MaliciousBehaviorFromNodeProcess

Version: 4

Description: Suspicious shell or script execution originating from a Node.js process

Macsyncstealer

Rule: LaunchDaemon

Version: 9

Description: LaunchDaemon created for persistence

Rule: CustomURLHandlerCreation

Version: 2

Description: Application that uses custom url handler created

Atomicsteal

Generic

Odysseysteal

Cve-2022-46689

Generic

Multiverze

Rule: LaunchDaemon

Version: 8

Description: LaunchDaemon created for persistence

Rule: LaunchAgent

Version: 7

Description: LaunchAgent created for persistence

Rule: LaunchDaemon

Version: 7

Description: LaunchDaemon created for persistence

Rule: LaunchAgent

Version: 6

Description: LaunchAgent created for persistence

Rule: LaunchAgent

Version: 5

Description: LaunchAgent created for persistence

Rule: LaunchDaemon

Version: 6

Description: LaunchDaemon created for persistence

Rule: KnownMaliciousCurlCommand

Version: 5

Description: Advanced Threat Controls (ATC) - Known Malicious curl Command Execution

Adagent

Multiverze

Rload

Odyssey

Rule: CurlStealerDownloader

Version: 19

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Atomicsteal

Generic

Multiverze

Rload

Atomic

Phexiastealer

Rule: CurlStealerDownloader

Version: 18

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: OsascriptGenericStealer

Version: 5

Description: Generic macOS infostealer activity detected via AppleScript execution

Generic

Multiverze

Rule: NestedAppSignatureMismatch

Version: 3

Description: Nested application signature mismatch

Rule: OsascriptGenericStealer

Version: 4

Description: Generic macOS infostealer activity detected via AppleScript execution

Icevein

Atomicsteal

Flexibleferret

Generic

Metasploit

Multiverze

Flexibleferret

Phexiastealer

Atomic

Rule: GatekeeperBlockedUnsignedOrUnknown

Version: 4

Description: Gatekeeper blocked an application

Atomicsteal

Tinyshell

Atomicsteal

Cve-2022-46689

Generic

Fscan

Generic

Jailbreak

Generic

Generic

Atomic

Macsyncstealer

Generic

Jailbreak

Multiverze

Adagent

Atomicsteal

Cve-2022-46689

Flexibleferret

Generic

Multiverze

Tuneupmymac

Rule: MaliciousBehaviorFromNode

Version: 3

Description: Suspicious curl command piped to shell executed by a Node.js parent process

Shubstealer

Rule: CurlStealerDownloader

Version: 17

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Odyssey

Atomic

Atomicsteal

Generic

Multiverze

Puagent

Adagent

Generic

Jailbreak

Multiverze

Rload

Adagent

Atomicsteal

Flexibleferret

Maltiverza

Rule: StealerDataExfiltration

Version: 5

Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Flexibleferret

Genericstealer

Generic

Gost

Multiverze

Rload

Rule: OsascriptGenericStealer

Version: 3

Description: Generic macOS infostealer activity detected via AppleScript execution

Novastealer

Macsyncstealer

Ruststealer

Flexibleferret

Odyssey

Generic

Multiverze

Rload

Genericobfuscatedscript

Multiverze

Adload

Cve-2022-46689

Dprk

Generic

Jailbreak

Multiverze

Poseidon

Rload

Dprk

Dprk

Minion

Rule: CurlStealerDownloader

Version: 16

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Rule: MaliciousBehaviorFromVSCodeTasks

Version: 5

Description: Known malicious commands executed through VSCode tasks for payload delivery

Invisibleferret

Generic

Rload

Poseidon

Adagent

Generic

Maltiverza

Multiverze

Poseidon

Rule: StealerDataExfiltration

Version: 4

Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Cve-2022-46689

Generic

Installmiez

Jailbreak

Multiverze

Xmrig

Odyssey

Genericstealer

Digitstealer

Generic

Generic

Multiverze

Rule: CurlStealerDownloader

Version: 15

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Digitstealer

Rule: CurlStealerDownloader

Version: 14

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Dprk

Generic

Limerain

Multiverze

Adload

Generic

Multiverze

Rload

Sliver

Synataeb

Rule: CurlStealerDownloader

Version: 13

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Atomic

Digitstealer

Sliver

Generic

Jailbreak

Metasploit

Miner

Multiverze

Sliver

Atomic

Rule: StealerDataExfiltration

Version: 3

Description: Advanced Threat Controls (ATC) - InfoStealer Exfiltration via curl command

Rule: CurlStealerDownloader

Version: 12

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Digitstealer

Generic

Rule: CurlBasedDeadDropResolver

Version: 1

Description: Curl used to retrieve command or configuration data from legitimate web services as a dead drop resolver technique

Rule: KnownMaliciousCurlCommand

Version: 4

Description: Advanced Threat Controls (ATC) - Known Malicious curl Command Execution

Xmrig

Generic

Maccontrol

Miner

Multiverze

Pirrit

Rload

Rule: CurlStealerDownloader

Version: 11

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Digitstealer

Generic

Multiverze

Rload

Genericstealer

Rule: CurlStealerDownloader

Version: 10

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Hackbrowserdata

Generic

Multiverze

Invisibleferret

Genericstealer

Dprk

Invisibleferret

Dprk

Generic

Multiverze

Dprk

Machdoser

Dprk

Generic

Dprk

Machdoser

Dprk

Atomicsteal

Dprk

Generic

Multiverze

Dprk

Atomic

Atomicsteal

Generic

Metasploit

Multiverze

Rule: CurlStealerDownloader

Version: 9

Description: Suspicious use of curl to download and execute potential InfoStealer payloads

Genericstealer

Atomicsteal

Cobaltstrikebeacon

Multiverze

Rule: XcodeExecutesCurl

Version: 5

Description: Suspicious curl command executed during Xcode build process

Rule: MaliciousBehaviorFromVSCodeTasks

Version: 4

Description: Known malicious commands executed through VSCode tasks for payload delivery

Rule: MaliciousBehaviorFromNode

Version: 2

Description: Suspicious curl command piped to shell executed by a Node.js parent process

Dprk

Genericstealer

Phexiastealer

Atomicsteal

Limerain

Miner

Multiverze

Rload

Odyssey

Rule: MaliciousBehaviorFromVSCodeTasks

Version: 3

Description: Known malicious commands executed through VSCode tasks for payload delivery

Genericstealer

Dprk