Becoming a Yogi on Mac ATT&CK with OceanLotus Postures

The talk starts from the common belief that MITRE ATT&CK only covers Windows. The presenters explain that its macOS matrix has existed since 2017 and describe how the framework is organized: tactics as adversary goals, techniques beneath them, and sub-techniques where operating system specifics usually live. Each entry carries a description, metadata, real-world procedure examples, detection ideas and references. They note that public reporting on macOS malware is thin, so much of the detail comes from community researchers.

Using the OceanLotus group as a case study, the speakers show how threat intelligence maps onto techniques, both from published reports and from malware samples attributed to the actor. They break a shell script into the behaviors it performs and match each one to an ATT&CK technique. They then cover threat hunting, pairing techniques with the data sources that would reveal them, and emulation, where existing plans and open-source tools can reproduce the same behaviors. Open reporting carries biases, so they stress adding an organization's own telemetry and internal intelligence.

The closing section compares what a team can currently see with what intelligence says adversaries do, to find gaps and set priorities. Responses may be new detections, data collection, user training, or accepted risk rather than only technical controls, and emulation is used to validate results. The main takeaway is a shared vocabulary across teams. The presenters also asked practitioners to share macOS findings so the framework can keep improving, and noted that automatically mapping reports to techniques is still an unsolved problem.