Farming The Apple Orchards: Living off the Land Techniques

The talk explores how attackers on macOS can rely on built-in utilities, APIs and data sources instead of custom malware. Cedric Owens starts with situational awareness, showing how mdfind can search inside files for credentials or AWS key identifiers, and how the Spotlight query API offers the same route. He also covers stripping quarantine attributes with ordinary commands, grabbing clipboard contents, checking for virtual machines, and judging whether a user is away from the screen. Unsaved TextEdit documents, Sticky Notes and plaintext Firefox cookies are presented as easily reached data.

Chris Ross then covers binaries for other stages. dns-sd browses Bonjour advertisements to reveal SSH, web, screen sharing and AirPlay services, and its traffic blends into normal local network noise. osacompile produces app bundles whose AppleScript or JXA source remains unobfuscated, which helps analysts but suggests payloads should be encrypted. lldb plugins can run Python through a .lldbinit file, and background threads avoid stalling the debugger. Audio Unit plugins loaded by auval can execute code from a bundle initializer during testing.

The talk ends with safaridriver, which exposes a WebDriver server that can carry C2 or second-stage downloads through a browser and look more legitimate. Its visible window and end-session prompt make it better suited to short-lived use. The practical takeaway is that native tools and their data stores deserve monitoring as much as dropped binaries.