Leveraging macOS Networking Frameworks to Heuristically Detect Malware
Patrick Wardle leverages overlooked low-level macOS APIs and private frameworks to build open-source host network monitoring tools for generic malware detection.
Summary
Network Telemetry as a Malware Detection Heuristic
Because nearly all macOS malware strains communicate over the network for command-and-control or exfiltration, host-level network inspection provides a universal detection signal.
Overcoming the Lack of Native macOS Network Tooling
While Windows offers mature packet filtering and event tracing frameworks, macOS historically lacked accessible, programmatic APIs for comprehensive socket and process attribution.
Deep Dive into Low-Level macOS Networking APIs
Patrick Wardle explores private frameworks, NetworkExtension providers, and kernel socket filters to programmatically inspect live network states, DNS queries, and traffic statistics.
Generic Detection of Known and Zero-Day Threats
Demonstrating open-source implementations illustrates how behavioral network telemetry generically detects both known APT malware and novel zero-day macOS threats without brittle signatures.
Related talks
Wild West Hackin' Fest·43 min
Kyle Avery
Industry experts analyze emerging threats surrounding EDR Internals for macOS and Linux | Kyle Avery.
Main Stage·47 min
Patrick Wardle
Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.
Main Stage·52 min
Patrick Wardle
Patrick Wardle provides an advanced guide to Apple's Endpoint Security framework, demonstrating how to build robust, kernel-level telemetry and macOS malware detection.