MacOS Behavioral Detections using Apple Endpoint Security API
summary
Covers building behavior-based detections from Apple’s Endpoint Security API with concrete patterns, example rules, and field names. Shows detections that caught Shlayer using a Gatekeeper bypass, a TCC screen‑recording piggyback via nested apps, and Safari zip unpacking that skips quarantine; each detection uses specific ES fields like process group ID, parent PID and command line, and checks such as code signing, quarantine xattr presence, and interpreter vs Mach‑O type. Demonstrations use ES Logger and Jamf Threat Labs telemetry and triggered real-world alerts.
AI-written summary · about
chapters (11)
- 0:00Introduction to macOS behavioral detections
- 1:28Endpoint Security API origins
- 4:42Static vs behavioral detections
- 6:30Fake file extensions detection
- 8:39Plist disguised as Apple detection
- 12:07Process activity context analysis
- 16:19Living off the land techniques
- 18:10Gatekeeper bypass vulnerability
- 26:58TCC bypass detection
- 31:59Safari quarantine attribute bypass
- 39:01Future of macOS security
related talks
29mHunting and Stopping Threats with Elastic Security
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
30mSpotting Threats with Elastic SIEM
45mAdvanced Security Operations with Elastic Security
50mDynamic Analysis of MacOS Malware Using SpriteTree
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
32mA Case Study of MacOS Supply Chain Compromise
29mDetection Engineering: Defending Networks with Purpose