This rule detects the presence of known indicators of compromise associated with the MacSync malware, which is frequently used to establish persistent access and exfiltrate data from macOS endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised devices before the adversary can leverage them for lateral movement or further data exfiltration within the environment.
Malware Family: MacSync Total IOCs: 16 IOC Types: url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | fincoadvance.com | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://aidevmaster.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381 | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://alabamarecoverycenter.com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://alluringsites.com/curl/d3a55738ee5c03c285567bd1e424bf9f731ca05150e69d3ed631f01eb0d0e521 | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://atlantaairporttaxiservice.com/curl/8e92ee3f0bccc8211145e3aee82c34e9ae67058e9abf154e4b335a6575f97833 | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://atlantaairporttaxiservice.com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://atlantaairporttaxiservice.com/curl/fa90319c89e7a0272c859f9f1403c6c2f12793281d3a295ce283d6018d5dd1c3 | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://bestbuydomain.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381 | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://byrnewealthmanagement.com/curl/1fb7b78a1dd8d2ae0b78c34784bad25d3fb0f13aad55e1e6e51c6c7b23bac23a | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://byrnewealthmanagement.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381 | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://cincycarpetcleaning.com/curl/6e2d25066bc1db68a10d55189c7c0bae6443d5178fd4310808270e261236ce30 | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://criminallawyerpr.com/curl/720e1e04c2690ac14874d54823354d6bd06336b23e8458debaffeb2b18f5be6a | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://criminallawyerpr.com/curl/85cb26206d920216eee0c5f67e8de516b4d55bd1752025bb3c08a069a44fdbdf | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://criminallawyerpr.com/curl/8e92ee3f0bccc8211145e3aee82c34e9ae67058e9abf154e4b335a6575f97833 | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://customroofingcontractors.com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e | payload_delivery | 2026-09-17 | 100% |
| url | hxxps://dallasirrigationservices.com/curl/fa90319c89e7a0272c859f9f1403c6c2f12793281d3a295ce283d6018d5dd1c3 | payload_delivery | 2026-09-17 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - MacSync
let malicious_domains = dynamic(["fincoadvance.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - MacSync
let malicious_urls = dynamic(["https://aidevmaster.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381", "https://alabamarecoverycenter.com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e", "https://alluringsites.com/curl/d3a55738ee5c03c285567bd1e424bf9f731ca05150e69d3ed631f01eb0d0e521", "https://atlantaairporttaxiservice.com/curl/8e92ee3f0bccc8211145e3aee82c34e9ae67058e9abf154e4b335a6575f97833", "https://atlantaairporttaxiservice.com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e", "https://atlantaairporttaxiservice.com/curl/fa90319c89e7a0272c859f9f1403c6c2f12793281d3a295ce283d6018d5dd1c3", "https://bestbuydomain.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381", "https://byrnewealthmanagement.com/curl/1fb7b78a1dd8d2ae0b78c34784bad25d3fb0f13aad55e1e6e51c6c7b23bac23a", "https://byrnewealthmanagement.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381", "https://cincycarpetcleaning.com/curl/6e2d25066bc1db68a10d55189c7c0bae6443d5178fd4310808270e261236ce30", "https://criminallawyerpr.com/curl/720e1e04c2690ac14874d54823354d6bd06336b23e8458debaffeb2b18f5be6a", "https://criminallawyerpr.com/curl/85cb26206d920216eee0c5f67e8de516b4d55bd1752025bb3c08a069a44fdbdf", "https://criminallawyerpr.com/curl/8e92ee3f0bccc8211145e3aee82c34e9ae67058e9abf154e4b335a6575f97833", "https://customroofingcontractors.com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e", "https://dallasirrigationservices.com/curl/fa90319c89e7a0272c859f9f1403c6c2f12793281d3a295ce283d6018d5dd1c3"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses rsync or unison to synchronize configuration files or build artifacts between a macOS development workstation and a Linux CI/CD runner. The specific file paths or hash values used in the sync process may match one of the 16 IOCs (e.g., a specific binary name like sync_helper or a known path like /usr/local/bin/macsync).
rsync, unison, or scp and the destination path is within standard CI/CD workspace directories (e.g., /var/lib/jenkins/workspace/, /home/ci/builds/).Scenario: An IT administrator performs a manual backup of a user’s home directory on a macOS endpoint using a custom script that invokes a utility named macsync.sh or similar, which is part of an internal backup toolchain. The script’s location or the specific command-line arguments may trigger an IOC match.
TimeMachine, CarbonCopyCloner, or internal backup_agent) or where the command line contains specific backup flags (e.g., --backup, --archive) and the user belongs to the IT-Admins group.Scenario: A security team deploys a custom YARA rule or a lightweight EDR agent component on macOS endpoints for testing purposes, which includes a binary or configuration file with a name or hash that coincides with one of the MacSync IOCs (e.g., a test binary named macsync_test).
/opt/security_tools/ or /usr/local/share/edr/ and the user is a member of the `Security-Team