Mastering Apple Endpoint Security for Advanced macOS Malware Detection
Patrick Wardle provides an advanced guide to Apple's Endpoint Security framework, demonstrating how to build robust, kernel-level telemetry and macOS malware detection.
Summary
The Evolution of macOS Security Telemetry
Apple transitioned from deprecated Kernel Extensions (KEXTs) to the Endpoint Security (ES) framework, providing user-space security products with kernel-level event monitoring and authorization capabilities.
Mastering Endpoint Security Events and Handlers
Patrick Wardle breaks down the technical implementation of ES clients, detailing how to subscribe to process execution, file system modifications, IPC mach messaging, and dynamic dylib loading events.
Detecting Advanced macOS Malware Tradecraft
Leveraging granular ES telemetry enables defenders to detect stealthy macOS malware techniques, including synthetic click generation, Dylib hijacking, LaunchDaemon persistence, and TCC permission bypasses.
Building Open-Source Defensive Tools
Sharing open-source detection engineering methodologies equips macOS administrators and security researchers to develop robust, native endpoint monitoring solutions.
Related talks
Creator Stage·43 min
Josh Pyorre
Explores building detection signatures from network transaction timing intervals to identify malicious command-and-control communication.
Main Stage·52 min
Rich Murphey
Rich Murphey explores intrusion prevention techniques on windows and unix at DEF CON 11, examining log-analysis and practical defenses.
Creator Stage·55 min
E Tahoun · L Hamida
Demonstrates how open-source data science models cluster heterogeneous security alerts to uncover coordinated multi-stage cyber attacks.