Tripwires in the Dark: Developing Behavior Detections for macOS

Colson Wilhoit, a senior security research engineer at Elastic, argues that macOS defenses built on signatures, YARA rules and machine learning models leave gaps, since notarized, signed samples often pass all three. He surveys the macOS threat landscape and the built-in controls such as Gatekeeper, TCC and SIP, along with the endpoint security framework and unified logs that endpoint tools rely on, and notes how attackers slip past each one.

The core of the talk is behavior detection, defined as rules that sequence observable actions and flag deviations from normal system behavior. He stresses that useful detections depend on selective, high-quality telemetry, knowledge of how macOS is meant to work, and tracking of current attacker techniques. He then walks through two examples from the Mythic C2 framework: an XPC-based execution method that appears as launchd spawning xpc_proxy to run itself, and in-memory JavaScript for Automation loading, which leaves library load events that are hard to avoid. Cases include an Amos-family sample caught by rules written for earlier, unrelated malware, and a DPRK intrusion that a single file-based rule flagged at a late stage.

To close, he covers network domain enrichment for catching Python-based initial access droppers, chaining rules with AI-assisted summarization, and Elastic's open-source rules and stack. The takeaway is that behavior rules raise attacker cost, keep working against new payloads, and fill gaps left by other controls.