When One Command Line Tells The Whole Attack: Detecting Amos Malware On MacOS

Amos is a macOS-focused infostealer designed to collect sensitive user data and maintain persistence on compromised devices.

Typical targets include:

• Browser data and session material
• Keychain credentials
• Cryptocurrency wallets
• Notes and local files

Instead of relying on standalone binaries, Amos heavily uses:

• AppleScript
• Shell commands
• Native macOS utilities

This allows it to blend into normal system activity while executing a full collection and staging workflow.

Amos activity is not defined by a single action. It is the combination of multiple behaviors executed in sequence.

Observed behaviors include:

• AppleScript execution for credential prompts
• Authentication checks using dscl
• Access to browser profile paths (Chrome, Firefox, Edge, Brave)
• Keychain access (login.keychain-db)
• Wallet discovery (e.g., Electrum)
• Data compression using ditto or zip
• Payload download via curl
• Application replacement or helper installation
• Persistence via LaunchDaemons
• Continuous script execution loops

Each of these on its own may appear benign.

However, when multiple of these appear in a single command-line execution, it strongly indicates:

• credential theft
• data collection
• staging for exfiltration
• persistence setup

This clustering is what makes the activity high signal.

This rule focuses on behavioral evidence inside process command lines, not just static hashes or known file names.

The detection identifies:

• Execution of common command-line interpreters such as bash, zsh, sh, osascript, perl, python, ruby, swift, expect, ksh, tcsh, and csh 
• Process command lines containing a significant number of strings associated with Amos malware tradecraft
• A calculated suspicion score based on matched command-line fragments
• An alert when the number of matched suspicious strings exceeds a defined threshold

Rather than relying on a single IOC, this method detects a cluster of attacker behaviors that together form a strong signal of malicious activity. This makes the analytic more resilient against minor tooling changes, renamed payloads, and infrastructure rotation.

In this implementation, an incident is triggered when the process command line contains more than 14 matched Amos-associated strings within the one-hour analysis window.

Data Source

• • Microsoft Defender XDR
  • Table: DeviceProcessEvents
  • Key field: ProcessCommandLine

This is critical for macOS visibility, where much of the activity is script-driven.

The following query represents the reference implementation behind:

Potential Amos Malware Activity Detected

Thresholds and filters can be tuned based on organizational requirements.

DeviceProcessEvents 

| where TimeGenerated > ago(1h) 

| where FileName has_any (
"bash", "zsh", "sh", "osascript", "perl", 
"python", "ruby", "swift", "expect", 
"ksh", "tcsh", "csh"
)

| extend MatchedStringsCount = 0 

// Amos IDs from Yara rule 

| extend MatchedStringsCount = MatchedStringsCount + iff(ProcessCommandLine has "osascript -e 'set release to true", 1, 0) 



| where MatchedStringsCount > 14 

| project 
TimeGenerated, 
DeviceName, 
AccountName, 
InitiatingProcessAccountUpn, 
FileName, 
FolderPath, 
ProcessCommandLine, 
InitiatingProcessFileName, 
InitiatingProcessCommandLine, 
MatchedStringsCount

Each result represents:

• A command-line interpreter or script execution on a macOS endpoint
• A process command line containing a large number of suspicious strings linked to Amos malware behavior
• A weighted behavioral signal rather than a single isolated artifact
• Host, account, process, and command-line context for investigation

This is high-value telemetry because it reflects active execution behavior on the device, not just passive indicators or reputation hits.

This should be treated as potential:

• Infostealer execution
• Credential theft
• Browser/session compromise
• Data staging or exfiltration
• Persistence deployment

!   A high matched-string score strongly suggests that the process is not performing routine scripting activity and instead is executing a workflow aligned with malware staging and collection logic.

When this detection triggers, recommended actions include:

1. Immediately isolate the affected macOS device if malicious execution is confirmed
2. Review the full ProcessCommandLine and parent-child process chain
3. Determine whether the script accessed browser profiles, keychain data, notes, or wallet-related paths
4. Investigate whether payloads were downloaded from remote infrastructure using curl or similar utilities
5. Search for persistence artifacts such as suspicious LaunchDaemons, helper plists, or recently dropped binaries
6. Reset credentials associated with the affected user, especially if credential prompts or keychain access occurred
7. Invalidate active browser sessions and tokens for business-critical applications
8. Review outbound network connections and exfiltration destinations
9. Scan other macOS endpoints for the same command-line fragments or persistence paths
10. Block related domains, URLs, hashes, and infrastructure across security controls

If browser data, keychain material, or wallet artifacts were accessed, treat the incident as a likely compromise of sensitive user data, not just suspicious script execution.

Recommended controls:

• Monitor and restrict AppleScript and shell interpreter abuse
• Enable command-line logging on macOS endpoints
• Limit access to keychain and sensitive user directories
• Monitor LaunchDaemon creation and modification
• Apply EDR controls to detect abnormal scripting behavior

• macOS endpoints
• Microsoft Defender for Endpoint (macOS)
• Microsoft Defender XDR
• Microsoft Sentinel

Traditional malware detection often focuses on:

• Known hashes
• File reputation
• Static YARA hits
• Signed versus unsigned binaries
• Domain or IP reputation

Modern macOS stealers often avoid obvious malware artifacts by:

• Using native interpreters and AppleScript
• Embedding logic inside command lines and scripts
• Reusing legitimate system utilities
• Staging data locally before exfiltration
• Establishing persistence with native macOS mechanisms

This detection surfaces a subtle but highly valuable behavioral anomaly:

A command-line process executing with a dense cluster of Amos-associated strings tied to credential theft, local collection, payload download, and persistence. 

That signal is difficult for attackers to fully suppress and can remain effective even when infrastructure, filenames, or delivery methods change.

Wizard Cyber specializes in behavior-driven detection engineering across Microsoft security platforms.

We design analytics that focus on:

• Infostealer behavior, not just malware signatures
• macOS tradecraft visibility in enterprise environments
• Credential theft and browser session compromise detection
• Persistence and collection activity across native tooling
• High-confidence alerts with investigation-ready context

By focusing on how attackers actually operate on modern endpoints, we help organizations detect malware like Amos before stolen credentials, browser sessions, financial data, or sensitive corporate information can be abused.