Modern macOS Threat Hunting

Karl Hiramoto, a VirusTotal software engineer who works mainly on sandboxing, opens with the platform's scale and how analysts can search it. He frames threat hunting as an iterative process that starts from a few indicators, such as a sample, a domain or a distinctive string, and expands through repeated pivots until the set covers a campaign. He demonstrates the search syntax, including detection counts, file types, submitter country, sandbox network behaviour, CVE tags and date ranges, and shows how the relationships view links files, domains and URLs.

The middle of the talk is a worked case study of a macOS adware campaign described in a report by AT&T Alien Labs. Searching one URL path from that report returned hundreds of samples, and a commonality tool exposed the domains they shared. Pivoting on one domain surfaced dozens more files, an IDS rule found additional matches, and a similarity search on a single hash returned structurally related samples. He then covers persistence locations that are easy to search for, and YARA, including retrospective and live hunts, rules that draw on sandbox behaviour, and a diff approach that compares a sample set against known false positives. That approach extracted a long byte pattern which matched about sixty further files.

The main takeaway for practitioners is to treat hunting as a loop: expand indicators, validate them, and follow how a campaign changes over time. He closes by encouraging users to submit more files, comment on samples and contribute open-source rules, and mentions a capture-the-flag challenge built on the platform.