Leveraging osquery to examine the XProtect Behavioral Service DB

Thu, 27 Jul 2023 00:00:00 +0000

Upon reading Mandiant’s “North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack”, one of the artifacts that stood out to me was the usage of XProtect’s Behavior Service DB. Until now, I had assumed all XProtect detections were signature based, but it sounds like Apple may be testing some behavioral-based rules to flag suspicious process executions in newer versions of MacOS.

Examining the DB locally using sqlite3

If you’d like to take a look at the DB on your own system, you can simply run sudo sqlite3 /var/protected/xprotect/XPdb:

Using Osquery to Detect Reverse Shells on MacOS

Sun, 21 Jan 2018 00:00:00 +0000

Reverse Shell Detection

One challenge when it comes to building defenses for MacOS are the numerous scripting languages that come pre-installed with the operating system. While it may be convenient for developers, it provides attackers with a variety of methods for establishing persistence and bootstrapping connections to command and control servers.

Once attackers gain a foothold on systems, they frequently like to gain shell access by launching reverse shells. The benefits of this are well documented here. As you might expect, there are numerous ways to initiate these connections using native utilities such as:

Osquery on clo.ng

Leveraging osquery to examine the XProtect Behavioral Service DB

Examining the DB locally using sqlite3

Using Osquery to Detect Reverse Shells on MacOS

Reverse Shell Detection