malware

FruitFly S0277

Type: malware
Platform: macOS
Created: 17 October 2018
Last modified: 16 April 2025

FruitFly is designed to spy on mac users.[1]

Techniques33rd pct

Tactics41st pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

FruitFly MITRE reference S0277

Command Obfuscation T1027.010 ↗

FruitFly executes and stores obfuscated Perl scripts.2

Stealth13 detection rules

Process Discovery T1057 ↗

FruitFly has the ability to list processes on the system.3

Discovery10 detection rules

File Deletion T1070.004 ↗

FruitFly will delete files on the system.4

Stealth30 detection rules

File and Directory Discovery T1083 ↗

FruitFly looks for specific files and file types.5

Discovery29 detection rules

Screen Capture T1113 ↗

FruitFly takes screenshots of the user's desktop.6

Collection15 detection rules

Launch Agent T1543.001 ↗

FruitFly persists via a Launch Agent.7

Persistence · Privilege Escalation4 detection rules

Standing S0277

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques733rd pct

33rd percentile · 67% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics541st pct

41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique13medBottom 25%

25th percentile · 75% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique10medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0medBottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 7 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 79Splunk ESCU (cumulative) · 31

Standing S0277

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...)	Emerging	experimental	file_event	macos	-	Persistence, Privilege Escalation Create or Modify System Process Launch Daemon Stealth Hide Artifacts Hidden Files and Directories	-	high	Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)	2025-11-22	—	e710a880-1f18-4417-b6a0-b5afdf7e3023
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
	See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
Splunk	The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2021-06-10	2026-05-13	cd80a6ac-c9d9-11eb-8839-acde48001122
	Detects execution of the builtin "rmdir" command in order to delete directories. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2023-03-07	41ca393d-538c-408a-ac27-cf1e038be80c
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
Splunk	The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...)	Anomaly	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Stealth Hide Artifacts Hidden Files and Directories Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6f3ccfa2-91fe-11eb-8f9b-acde48001122
	Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Files and Directories	-	medium	frack113	2022-04-02	2024-03-26	5a5152f1-463f-436b-b2f5-8eceb3964b42
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Detects the deletion of files by the Sysinternals SDelete utility. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2023-02-15	6ddab845-b1b8-49c2-bbf7-1a11967f64bc
	Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries t (...)	Generic	stable	process_creation	linux	Sysmon	Stealth Indicator Removal File Deletion	-	informational	Ömer Günal, oscd.community	2020-10-07	2022-09-15	30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
	Detects execution of the builtin "del"/"erase" commands in order to delete files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2024-03-05	379fa130-190e-4c3f-b7bc-6c8e834485f3
	Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	medium	frack113 , X__Junior (Nextron Systems)	2021-12-02	2023-09-11	204b17ae-4007-471b-917b-b917b315c5db
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	Detects adversary creating hidden file or directory, by detecting directories or files with . (...)	Generic	test	process_creation	linux	Linux Auditd	Stealth Hide Artifacts Hidden Files and Directories	-	low	Pawel Mazur	2021-09-06	2025-06-16	d08722cd-3d09-449a-80b4-83ea2d9d4616
	Detects usage of attrib.exe to hide files from users.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Files and Directories	-	medium	Sami Ruohonen	2019-01-16	2023-03-14	4281cb20-2994-4580-aa63-c8b86d019934
	Detects the invocation of PowerShell commands with references to classes from the "System.Security.Cryptography" namespace. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information Command Obfuscation	-	medium	Andreas Braathen (mnemonic.io)	2023-12-01	—	ad856965-f44d-42a8-945e-bbf7bd03d05a
	Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.	Generic	test	process_creation	macos	-	Persistence, Privilege Escalation Create or Modify System Process Launch Agent Launch Daemon Execution System Services Launchctl	-	medium	Pratinav Chandra	2024-05-13	—	ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
Splunk	The following analytic detects the deletion of SSH keys on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	73a56508-1cf5-4df7-b8d9-5737fbdc27d2
Splunk	The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-23	2026-05-13	f616c4f3-bde9-41cf-856c-019b65f668bb
Splunk	The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-22	2026-10-02	0bbfb79c-a755-49a5-a38a-1128d0a452f1
Splunk	The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	555cc358-bf16-4e05-9b3a-0f89c73b7261
Splunk	The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	eec78cef-d4c8-4b35-8f5b-6922102a4a41
	Detects attempts to discover the files with setuid/setgid capability on them. (...)	Generic	test	process_creation	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Discovery File and Directory Discovery	-	low	Pawel Mazur	2021-11-28	2022-12-25	fe10751f-1995-40a5-aaa2-c97ccb4123fe
Splunk	The following analytic detects the deletion of cron jobs on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	3b132a71-9335-4f33-9932-00bb4f6ac7e8
Splunk	The following analytic detects the deletion of init daemon scripts on a Linux machine. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	729aab57-d26f-4156-b97f-ab8dda8f44b1
Splunk	The following analytic detects the deletion of services on a Linux machine. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	b509bbd3-0331-4aaa-8e4a-d2affe100af6
Splunk	The following analytic detects the deletion of SSL certificates on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	839ab790-a60a-4f81-bfb3-02567063f615
Splunk	The following analytic detects a high frequency of file deletions in the /boot/ folder on Linux systems. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	e27fbc5d-0445-4c4a-bc39-87f060d5c602
Splunk	The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	9d867448-2aff-4d07-876c-89409a752ff8
Splunk	The following analytic detects the deletion of Linux service unit configuration files by suspicious processes. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2023-02-08	2026-05-13	6c077f81-2a83-4537-afbc-0e62e3215d55
Splunk	The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...)	Anomaly	stable	process_creation	-	Osquery	Stealth Hide Artifacts Hidden Files and Directories	-	medium	Raven Tait, Splunk	2026-04-14	2026-05-13	51c43b7b-e406-45d2-9bad-5c67f07e6528
	Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	The DFIR Report	2025-02-21	—	3b4e950b-a3ea-44d3-877e-432071990709
	Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information Command Obfuscation Stealth System Binary Proxy Execution Msiexec	-	high	Meroujan Antonyan (vx3r)	2025-05-27	—	7b6a7418-3afc-11f0-aff4-000d3abf478c
	Detects the enabling of the "EnablePeriodicBackup" registry value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-01	—	973ef012-8f1a-4c40-93b4-7e659a5cd17f
	Detects usage of "find" binary in a suspicious manner to perform discovery	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	—	8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
	Detects usage of "find" binary in a suspicious manner to perform discovery	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	—	85de3a19-b675-4a51-bfc6-b11a5186c971
	Detects execution of "rundll32" with potential obfuscated ordinal calls	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information Command Obfuscation	-	medium	Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2023-05-17	2025-02-23	43fa5350-db63-4b8f-9a01-789a427074e1
	Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utilit (...)	Generic	test	process_creation	macos	-	Persistence, Privilege Escalation Create or Modify System Process Launch Agent Launch Daemon	-	high	Sohan G (D4rkCiph3r)	2023-02-18	—	65d506d3-fcfe-4071-b4b2-bcefe721bbbb
	Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Process Discovery Execution Windows Management Instrumentation	-	medium	frack113	2022-01-01	2025-12-15	221b251a-357a-49a9-920a-271802777cc0
	Detects files that have extensions commonly seen while SDelete is used to wipe files.	Generic	test	-	windows	WinEventLog Security	Impact Data Destruction Stealth Indicator Removal File Deletion Stealth Obfuscated Files or Information Indicator Removal from Tools Defense Impairment Subvert Trust Controls Code Signing	-	medium	Thomas Patzke	2017-06-14	2024-12-13	39a80702-d7ca-4a83-b776-525b1f86a36d
	Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	medium	X__Junior (Nextron Systems)	2023-07-18	2024-03-06	ded2b07a-d12f-4284-9b76-653e37b6c8b0
	Detects technique used by MAZE ransomware to enumerate directories using Powershell	Generic	test	ps_script	windows	PowerShell	Discovery File and Directory Discovery	-	medium	frack113	2022-03-17	—	162e69a7-7981-4344-84a9-0f1c9a217a52
	Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShe (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information Command Obfuscation	-	high	Norbert Jaśniewicz (AlphaSOC), Swachchhanda Shrawan Poudel (Nextron Systems)	2026-10-06	—	0c3ebe9f-df09-4e00-be0f-73d4ca8d62f6

Title

Description