MacOS_Backdoor_Applejeus_71c0acb0

rule MacOS_Backdoor_Applejeus_71c0acb0 {
    meta:
        author = "Elastic Security"
        id = "71c0acb0-c326-4d9d-91c6-039560a4b574"
        fingerprint = "25cc2a29480b78c196f919c735918cbb98325f200d68ddc9bfcebc13aa439a21"
        creation_date = "2026-02-27"
        last_modified = "2026-04-06"
        threat_name = "MacOS.Backdoor.Applejeus"
        reference_sample = "e352d6ea4da596abfdf51f617584611fc9321d5a6d1c22aff243aecdef8e7e55"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $a = { 89 C1 83 E1 0F 42 8A 0C 39 41 30 0C 04 48 FF C0 }
        $b = { 41 C7 07 00 00 00 00 BE 00 00 03 00 4C 89 E7 }
    condition:
        all of them
}