macOS Internals for Threat Detection Engineers

Olivia Gallucci opens by framing the problem: macOS produces a lot of security-relevant data, but it is hard to reach and noisy. She walks through the Unified Logging System, which records operating system and application events asynchronously and is mostly useful for context and correlation rather than real-time alerting. She then covers Endpoint Security, Apple's userland event API, and the tools used to read its events, along with the TCC database that stores privacy permission decisions.

The middle of the talk turns to persistence and abuse. Launch agents, launch daemons, login items and AppleScript run through osascript are presented as common ways malware keeps running or obtains user input. Examples come from families such as Atomic Stealer and XCSSET. Gallucci describes how Atomic Stealer hides its scripts through runtime string decoding and presents fake system password prompts, which evade defenses that focus only on exploits.

For the closing portion, she proposes detection built on behavior rather than signatures. The ideas include combining unusual osascript calls that display dialogs with hidden answers, high-entropy command-line arguments, unsigned parent processes, and outbound network traffic shortly after a prompt. She points to Mac Monitor and the Red Canary atomic test harnesses for generating and checking telemetry. The takeaway is that defenders should correlate several telemetry layers to find infostealer activity on macOS.