Gotta Catch 'em All

The talk offers a short list of high-signal, low-false-positive macOS detections that standard EDR and SIEM setups can run. The first is dns-sd, which an intrusion group used to query Bonjour on the local network. SSH-enabled Macs answer such queries, letting the attacker locate lateral movement targets without scanning. Attacker mistakes form another category: netcat run with the -e flag fails on macOS's BSD netcat, so legitimate automation rarely uses it and its presence is suspicious.

Infostealers came next. Most begin with an AppleScript dialog asking the user for a password, so detections look for AppleScript arguments mentioning password or credentials. Other signals include AppleScript running virtualization checks and dscl verifying a typed password before the malware proceeds. Stealers reuse command-line patterns, so recurring strings make durable targets. A Flutter application that loads a backdoor as a dylib was also shown, a case that hides the payload from standard endpoint events and requires extra telemetry.

The final scenario was remote-worker fraud, in which stolen identities place company laptops in laptop farms operated remotely. Hunting ideas include finding machines with several remote-access tools such as GoToMeeting, LogMeIn, RustDesk or AnyDesk, and unsanctioned VPN or screenshot software. Teams can also check whether new hires have been met in person and look for duplicate worker profiles. Admins with MDM search can run these combinations without security telemetry. The talk closes by pointing to a 2024 Mandiant report for further leads.