Skip to content

Instantly share code, notes, and snippets.

@cedriczirtacic

cedriczirtacic/macos_monitoring.md

Last active July 25, 2018 14:14
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save cedriczirtacic/652f5209eb2f9bdddc3f88bff603096e to your computer and use it in GitHub Desktop.
Save cedriczirtacic/652f5209eb2f9bdddc3f88bff603096e to your computer and use it in GitHub Desktop.
Download ZIP
Cheatsheet based on Patrick Wardle's talk: "Offensive Malware Analysis: Dissecting OSX FruitFly"
Raw
macos_monitoring.md

macOS X malware behavior monitoring (quick cheatsheet)

  • Network:
  • OS X:
    • Check general logs: ~/Library/Logs/*
      • CoreAnalytics (>= OS X 10.13): /Library/Logs/DiagnosticReports/
      • Emond logs for persistence: /Library/Logs/EventMonitor/
    • ls -ltr ~/Library/LaunchAgents/*.plist
    • /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump (dump registered file handlers)
    • Certificates:
      • spctl --assess -v --type install <file>
      • codesign -dvvv <file>
  • Filesystem:
  • Process:
    • lsappinfo:
      • lsappinfo -v -all processlist (process list)
      • lsappinfo -v info <bundleID>
      • lsappinfo metainfo _(shows meta information of session, combine it with all for all sessions)
    • procMonitor
    • Task Explorer
    • ps
  • Peripherals monitoring:

(talk slides)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment