Dropping Lotus Bombs: ATT&CK in macOS Purple Team Operations

Public adversary emulation resources have offered little for macOS, which made it hard for the presenters to test detections against realistic attacker behavior. Their answer was an emulation plan for OceanLotus, a suspected Vietnamese threat group, now published in the MITRE Adversary Emulation Library. Without in-house reverse engineers, the team worked from public vendor reporting and rebuilt the group's implant, command-and-control message format and dynamic library loading as ATT&CK-mapped steps. They also noticed that reports titled as new backdoors often described the same implant over several years.

The middle of the talk covered detection. Alerting on every unsigned launch agent produced constant false positives across a fleet of several thousand machines. The approach shifted to alerting only when a new unsigned agent had no VirusTotal record or a known-bad verdict. The presenters then described a normalized baseline method: compare each command against a fourteen-day history and a short sample window, normalize variable values such as interface names and temporary paths, and check whether the parent process is new or common. Timestomping with touch served as a worked example, where the approach filtered routine developer tooling down to a usable signal.

The main takeaway is to aim detections at attacker behaviors that are costly to change, rather than easily swapped indicators. Validate them with emulation that records full process context and points to the code behind each technique, so blue teams can separate attacker activity from legitimate software. Red teams can supply that context in their reports. The emulation code and hunting playbooks are open for community contributions.