Skip to content

Snap Mac Detections#3935

Open
RavenTait wants to merge 10 commits intodevelopfrom
mac_from_snap
Open

Snap Mac Detections#3935
RavenTait wants to merge 10 commits intodevelopfrom
mac_from_snap

Conversation

@RavenTait
Copy link
Copy Markdown
Contributor

Added new Mac OS detections and analytic stories

Detections:

  • MacOS Account Created
  • MacOS Data Chunking
  • MacOS Gatekeeper Bypass
  • MacOS Hidden Files and Directories
  • MacOS Kextload Usage
  • MacOS Keychains Dumped
  • MacOS Log Removal
  • MacOS Loginhook Persistence
  • MacOS Network Share Discovery

Stories

  • MacOS Post-Exploitation
  • MacOS Persistence Techniques
  • MacOS Privilege Escalation

@RavenTait RavenTait added the WIP DO NOT MERGE Work in Progress label Mar 3, 2026
@nasbench nasbench added this to the v5.25.0 milestone Mar 16, 2026
@nasbench
Copy link
Copy Markdown
Contributor

Moving this to v5.25.0 since the TA missed out on this release.

@patel-bhavin patel-bhavin modified the milestones: v5.25.0, v5.26.0 Mar 31, 2026
@nasbench
Copy link
Copy Markdown
Contributor

Added the OSquery TA. So now unit testing should pass if the searches are accurate. This PR is now targeting 5.26

@nasbench
Copy link
Copy Markdown
Contributor

FYI. My review is in progress

Copy link
Copy Markdown
Contributor

@nasbench nasbench left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall LGTM just some minor metadata updates like RBA stuff, references and some logic suggestions/questions

@nasbench nasbench removed the WIP DO NOT MERGE Work in Progress label Apr 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants