Introducing the Next Generation of Mac Monitor

The talk introduces version 2.0 of Mac Monitor, a SwiftUI app that gives analysts a ProcMon-style view of macOS activity by reading Apple's Endpoint Security event stream. The speaker explains that the tool subscribes only to notification events, so it runs alongside other endpoint agents without authorizing anything. He describes the architecture, a root system extension that passes events over XPC to the interface, and the difficulty of managing high event volume through path muting and inversion.

A major theme is enrichment. Raw Endpoint Security data lacks details such as property list contents, file quarantine state and decoded certificates, so the client has to add them. The speaker ties this to two Gatekeeper bypasses he found in 2023 after spotting unquarantined downloads, one of which turned out to be a macOS bug. The new release standardizes its telemetry to the format of Apple's ESLogger and adds events for sockets, file metadata and pseudo-terminal grants. It also lets users trace only a chosen process tree, search and export mute lists, subscribe to events at runtime, and receive in-app updates.

A live demo runs Atomic Red Team tests for AppleScript execution and reflective code loading. The speaker filters to the relevant process tree and correlates events by audit token to show an in-memory library mapping and a short-lived file written to disk. The closing message is that defenders can use the tool to prototype detections, and the speaker invites feedback and contributions to the project, which can be installed with Homebrew.