What does APT Activity Look Like on macOS? I often get asked what Advanced Persistent Activity (APT) or nation state hacking looks like on a macOS system. This is a great question and the answer is not widely known. Every APT entity has its own unique craft, but I often Read more…
Detecting SSH Activity via Process Monitoring During my time as a threat hunter, I’ve seen many intrusions start via SSH access using legitimate credentials. Now you might be thinking why on earth are users enabling the SSH service on macOS. Is that really necessary for basic users? Of course for Read more…
Download TrueTree Incident Response With TrueTree TrueTree is an open-source tool designed by me for threat hunters, incident responders, or anyone in between. If you read part one of this blog post, you know that nearly all processes on MacOS end up getting shown as a child of launchd due Read more…
Download TrueTree The TrueTree Concept The process tree is incredibly important when it comes to threat hunting. It doesn’t matter what platform you’re on. Every action that occurs on the operating system can be tied back to the process that caused it. Based on the combined actions that this process Read more…
Low-Level Process Hunting on macos Parent/child relationships are one of the simplest and most effective ways to detect malicious activity at the host level. On Unix, multiple methods can be used to create a process, all of which result in a different behavior on the operating system. These days, a Read more…