Rule Info
Name
SUSP_MacOS_Bash_System_Recon_Bundle_Aug26
Author
MalGamy
Description
Detects a bash script harvesting CPU, memory, OS version and public IP together, characteristic of infostealer targeting recon
Score
65
Date
2026-08-19
Minimum Yara
3.5.0
Rule Hash
9f0bb4ab323b3528d09de74bef84ddad
Tags
['T1059_004', 'SCRIPT', 'MACOS', 'SUSP']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
6
Suspicious (< 10 engines)
2
Clean (0 engines)
18
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR