Leveraging osquery to examine the XProtect Behavioral Service DB

Thu, 27 Jul 2023 00:00:00 +0000

Upon reading Mandiant’s “North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack”, one of the artifacts that stood out to me was the usage of XProtect’s Behavior Service DB. Until now, I had assumed all XProtect detections were signature based, but it sounds like Apple may be testing some behavioral-based rules to flag suspicious process executions in newer versions of MacOS.

Examining the DB locally using sqlite3

If you’d like to take a look at the DB on your own system, you can simply run sudo sqlite3 /var/protected/xprotect/XPdb:

Macos on clo.ng

Leveraging osquery to examine the XProtect Behavioral Service DB

Examining the DB locally using sqlite3