ATT&CKing Pandas: Drawing out ATT&CK Techniques in the Wild

Cat Self, the macOS lead for the ATT&CK project at MITRE, opens with a short overview of how the framework is organized into tactics, techniques and sub-techniques. The point is that entries should describe what an adversary actually does on a platform, not just match the name of a feature. The talk uses a comic-strip analogy to explain how macOS security mechanisms are meant to work, starting with file quarantine, code signing, notarization and Gatekeeper, and then how malware such as Shlayer gets past them.

The middle section covers discovery and persistence on the platform. Examples include using Bonjour and mDNS queries to find other Macs and their services, abusing apps that already hold sharing permissions, and hiding payloads in application bundles, resource forks or stripped run-only AppleScript. The Osa Miner case shows how missing decompiler support delayed analysis for years. Installer package scripts, which run alongside credential prompts, and BPF-filter socket listeners that activate backdoors later are also mapped to techniques.

The closing part stresses that recent ATT&CK changes for macOS came from community feedback, and that some new entries were still in draft at the time. The speaker urged researchers to publish reports on macOS activity, since the gap between reporting and publication slows coverage. In the Q&A, the speaker said red-team techniques are not planned for ATT&CK itself, though a separate project could cover them.