Diana Initiative 2021-Megan Carney-Bobbing for Apples: Developing alerts for macOS
Channel: The Diana Initiative
Date: 2021-08-12

Diana Initiative 2021
Megan Carney
Bobbing for Apples: Developing alerts for macOS

Knowing what malicious activity looks like in macOS and developing viable detection in an enterprise environment are separate challenges. Detections that seem simple at first glance, like applications spawning shell commands, are often frustrated by shortcuts used by legitimate software products. Other detections, like identifying malicious cron jobs, are complicated by user behavior. Additionally, enterprise endpoint detection tools are not always macOS-aware. Just because your EDR runs on a macOS machine doesnâ€™t mean the EDR understands the internals of macOS, and what artifacts are significant.



This presentation will focus on strategies for developing macOS alerts within enterprise environments, and what lessons can be carried forward if you already familiar with detection on Windows endpoints.