Detection

Leveraging osquery to examine the XProtect Behavioral Service DB

Chris Long

3 minute read

<p>Upon reading Mandiant’s <a href="https://www.mandiant.com/resources/blog/north-korea-supply-chain">“North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack”</a>, one of the artifacts that stood out to me was the usage of XProtect’s Behavior Service DB. Until now, I had assumed all XProtect detections were signature based, but it sounds like Apple may be testing some behavioral-based rules to flag suspicious process executions in newer versions of…

Using Osquery to Detect Reverse Shells on MacOS

A deeper look into the significance of TTYs for detection

Chris Long

7 minute read

<p>One challenge when it comes to building defenses for MacOS are the numerous scripting languages that come pre-installed with the operating system. While it may be convenient for developers, it provides attackers with a variety of methods for establishing persistence and bootstrapping connections to command and control servers.</p>