Mobile profile configurations (.profile files)ĭuring this workshop we will be utilising Cody Thomas's Mythic post-exploitation framework.

Phishing is arguably the most effective means of gaining access to a device, with common payload types such as: The vectors used to achieve a foothold on macOS devices are no different from those of other major operating systems. So to kick things off let's dive right into our first lab. A number of these are not designed to be deployed at scale, but rather to simply demonstrate the telemetry that is available on macOS and that should be gathered by your EDR solution.

This workshop is not intended to cover all of the impressive macOS attacks we've seen in the wild, but rather to aid in developing macOS detection capability.Ī recording of this workshop series can be found here and the slides are available here.īefore we begin this series, it is wise to acknowledge that throughout this workshop we have employed a lot of open source tools to gather the required telemetry. Initial access via Office Macros (inc.The labs for this workshop are comprised of the following key areas: Over the three labs we have set out for this workshop, we're aiming to develop an initial level of understanding for some of the attacks we see against macOS and most importantly how we can implement appropriate detections.

Mac os process monitor sandboxd