| Threat Type | Example | macOS Specificity | |-------------|---------|--------------------| | | Atomic Stealer, Realst | Target browser cookies, crypto wallets, Keychain passwords | | Ransomware | LockBit for Mac (ESXi locker) | Encrypts user directories, leverages osascript for persistence | | Phishing | Fake login prompts (Apple ID) | Bypasses MFA via session token theft (not just password) | | Supply chain | Compromised Homebrew/Swift packages | Privilege escalation via sudo during install | | Adversary-in-the-Middle | EvilQuest variant | Uses AppleScript to control UI and approve dialogs |
Most Mac breaches start with social engineering (disabling Gatekeeper via terminal commands) or weak user privileges (running daily work as admin). 2. Apple’s Native Security Stack: What It Does (and Doesn’t Do) Apple provides a solid foundation—but with gaps. mac endpoint security
Any EDR must have full disk access (FDA) and kernel extension approval (or System Extensions on Apple Silicon). Without FDA, you cannot scan ~/Library/Keychains or ~/Library/Mail . 5. Detection Queries Every Mac Admin Should Run Use these to hunt for compromise (via your EDR or osquery ). 5.1 Suspicious LaunchAgents (Persistence) SELECT * FROM launchd WHERE path LIKE '/Users/%/Library/LaunchAgents/%' AND (name LIKE '%update%' OR name LIKE '%java%' OR name LIKE '%google%'); -- Look for masquerading names 5.2 Users Running with UID 0 (Privilege Escalation) ps aux | awk '$1=="root" print $11' | sort -u # Check for unexpected processes like Python, Ruby, Node running as root 5.3 Bypass of Gatekeeper find /Applications -name "*.app" -exec spctl --assess --verbose {} \; # Any output "rejected" is fine; "accepted" but from untrusted source is suspicious 5.4 Unusual AppleScript Usage (UI control) grep -r "osascript" /Users/*/Library/Logs/ # Combined with login items = possible infostealer 5.5 Keychain Access Attempts Monitor security command line invocations: | Threat Type | Example | macOS Specificity
| Feature | Protection Provided | Known Gap | |---------|---------------------|------------| | (System Integrity Protection) | Prevents modification of system files even by root | Does not protect user data ( /Users/ ) or third-party apps | | Gatekeeper | Blocks unsigned/unnotarized apps by default | User can right‑click → Open, ignoring warning | | XProtect | Signature‑based malware removal | No heuristic/behavioral detection; slow signature updates | | Notarization | Scans apps for known malware pre‑execution | Attackers now use steganographic payloads or time‑delayed fetches | | TCC (Transparency, Consent, Control) | Controls access to camera, microphone, files | Users click “Allow” habitually; no central audit for enterprise | | MDM (Managed Device Config) | Enforces policies remotely | Requires proper configuration – default is lax | Any EDR must have full disk access (FDA)