splApache-2.0from splunk/security_content

MacOS AMOS Stealer - Virtual Machine Check Activity

The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings. This activity is significant as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not. If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml

`osquery_macro`
name=es_process_events
columns.cmdline="*osascript*"
columns.cmdline="* -e *"
columns.cmdline="*set*"
columns.cmdline="*system_profiler*"
columns.cmdline IN ("*VMware*", "*QEMU*")

| rename columns.* as *

| stats  min(_time) as firstTime max(_time) as lastTime
  values(cmdline) as cmdline,
  values(pid) as pid,
  values(parent) as parent,
  values(path) as path,
  values(signing_id) as signing_id,
  by username host

| rename
  username as user,
  cmdline as process,
  parent as parent_process,
  path as process_path,
  host as dest

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `macos_amos_stealer___virtual_machine_check_activity_filter`