ICMacOS Stealer-to-RAT Evolution + DarkCore Session-Hijacking RAT: OTX Pulse Analysis — Enterprise Detection Pack

---
title: ICMacOS macOS Stealer LaunchAgent Persistence
id: 7a3f1c2e-9b4d-4e1a-8c5f-2d6b9a0e1f34
status: experimental
description: Detects creation of LaunchAgent/LaunchDaemon plist files consistent with ICMacOS (Icarus macOS) persistent RAT installation
author: Security Arsenal
references:
  - https://socradar.io/blog/icmacos-infostealer-rat
date: 2026/10/27
logsource:
  product: macos
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
  selection_unsigned:
    TargetFilename|endswith: '.plist'
  filter_legit:
    TargetFilename|contains:
      - 'com.apple.'
      - 'com.google.'
      - 'com.microsoft.'
  condition: selection_path and selection_unsigned and not filter_legit
fields:
  - TargetFilename
  - Image
  - User
level: high
tags:
  - attack.persistence
  - attack.t1543.001
  - attack.t1543.004
---
title: Suspicious osascript / Shell Execution Stealer Behavior (ICMacOS / AMOS Family)
id: 2b8e4d1a-6c3f-4a9b-b7e2-5d0c8f1a3e56
status: experimental
description: Detects osascript or curl-piped-shell execution patterns used by macOS stealers for credential and keychain theft via ClickFix-style lures
author: Security Arsenal
references:
  - https://socradar.io/blog/icmacos-infostealer-rat
date: 2026/10/27
logsource:
  product: macos
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '/osascript'
      - '/bash'
      - '/zsh'
      - '/curl'
  selection_cmd:
    CommandLine|contains:
      - 'keychain'
      - 'security find-generic-password'
      - 'curl -s'
      - '| bash'
      - '| zsh'
      - 'Login Data'
      - 'Cookies'
      - 'Cookies.binarycookies'
  condition: selection_img and selection_cmd
level: critical
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1555.001
  - attack.t1059
---
title: DarkCore Browser Credential and Cookie Database Access
id: 4c1f7a9d-8e2b-4d6c-a3f1-9b0e5d7c2a48
status: experimental
description: Detects non-browser processes accessing Chrome/Edge credential and cookie databases, consistent with DarkCore session-hijacking cookie theft
author: Security Arsenal
references:
  - https://www.blackfog.com/darkcore-a-data-theft-rat-with-a-session-hijacking-browser
date: 2026/10/27
logsource:
  category: file_event
  product: windows
detection:
  selection_files:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Cookies'
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Local State'
      - '\Microsoft\Edge\User Data\Default\Cookies'
      - '\Microsoft\Edge\User Data\Local State'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_files and not filter_browsers
level: high
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1539

// DarkCore + ICMacOS IOC & Behavior Hunt — Microsoft Sentinel
let C2IPs = dynamic(["85.137.253.61", "45.13.186.247"]);
let C2Domains = dynamic(["escapeai.live", "mikoblico.xyz", "update.cdnlinks.org"]);
let Hashes = dynamic(["5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8","8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a","62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17","857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0","2deedea02811bb8e288db1a96aac44bbfb533fd624b25f000823fa92baabd9a1","5102c02a158bd53649de66ecf627966f744e4fd46240523eb6cd11c348b2dfab","0530f78227fa92b7b2d716c6a8253405a83e4b9b4a0c84736f1a0863ff500925"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (C2IPs) or RemoteUrl in (C2Domains)
| extend IOCType = "Network-C2"
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, IOCType),
(DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in (Hashed) or FileName =~ "ReportPDFReader.exe"
| extend IOCType = "FileHash"
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, IOCType),
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (FileName =~ "osascript" and ProcessCommandLine has_any ("keychain","find-generic-password"))
     or (ProcessCommandLine has_any ("| bash","| zsh") and ProcessCommandLine has "curl")
| extend IOCType = "macOS-Stealer-Behavior"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, IOCType)
| sort by TimeGenerated desc

# Security Arsenal — DarkCore RAT Windows Host Hunt
# Checks persistence artifacts, lure file presence, cookie-store tampering, and live C2 connections

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# 1. Lure executable artifacts
$lurePaths = @("$env:TEMP\ReportPDFReader.exe","$env:USERPROFILE\Downloads\ReportPDFReader.exe","$env:APPDATA\ReportPDFReader.exe","$env:LOCALAPPDATA\ReportPDFReader.exe","$env:ProgramData\ReportPDFReader.exe")
foreach ($p in $lurePaths) {
    if (Test-Path $p) { $findings += "[FILE] Lure payload found: $p" }
}

# 2. Known DarkCore hashes — scan common staging dirs
$badHashes = @("1782cd071bb973b3e24aa0ec49bc5a77","441a67671330483c53ab5fb9845c5b3a","38431ea1cd034fba9771c6c187a57657")
Get-ChildItem "$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData" -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
    if ($badHashes -contains $h) { $findings += "[HASH] Malicious file: $($_.FullName) ($h)" }
}

# 3. Persistence: Run keys and suspicious scheduled tasks
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    Get-ItemProperty $k | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'ReportPDFReader|cdnlinks|AppData.*\.exe' } | ForEach-Object {
            $findings += "[RUNKEY] $($k): $($_.Name) = $($_.Value)"
        }
    }
}
Get-ScheduledTask | Where-Object { $_.TaskName -match 'update|cdn|report' -and $_.Actions.Execute -match 'AppData|Temp' } | ForEach-Object {
    $findings += "[TASK] Suspicious scheduled task: $($_.TaskName) -> $($_.Actions.Execute)"
}

# 4. Live connections to ICMacOS C2 infrastructure
$c2 = @("85.137.253.61","45.13.186.247")
Get-NetTCPConnection -State Established | Where-Object { $c2 -contains $_.RemoteAddress } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess).ProcessName
    $findings += "[NET] Active C2 connection: $($_.RemoteAddress):$($_.RemotePort) via $proc (PID $($_.OwningProcess))"
}

# 5. Recent cookie/Login Data access timestamp anomaly (proxy for theft)
$cookiePaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Network\Cookies","$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data","$env:LOCALAPPDATA\Google\Chrome\User Data\Local State")
foreach ($c in $cookiePaths) {
    $f = Get-Item $c
    if ($f -and $f.LastAccessTime -gt (Get-Date).AddHours(-2) -and $f.LastAccessTime -gt $f.LastWriteTime) {
        $findings += "[CRED] Recent anomalous access to credential store: $c at $($f.LastAccessTime)"
    }
}

if ($findings.Count -eq 0) { Write-Output "CLEAN: No DarkCore/ICMacOS artifacts on $env:COMPUTERNAME" }
else { $findings | ForEach-Object { Write-Output $_ } }