If someone wants to learn MacOS IR/forensics what’s the best resource for that?

macOS-IR-Forensics.md

• Sarah Edwards (@iamevltwin)

  • mac4n6.com
  • SANS FOR518: Mac and iOS Forensic Analysis and Incident Response
  • Apple Pattern of Life Lazy Output'er

• Unified Log

  • Howard Oakley @howardnoakley
    • Unified log: 1 why, what and how
    • Unified log: 2 content and extraction
    • Unified log: 3 finding your way
    • Full description of the macOS unified log (Paid Paper)
  • Leveraging the Apple Unified Log for Incident Response (CrowdStrike)

• Persistence

  • Beyond good ol' LaunchAgents by Csaba Fitzl
  • KnockKnock
    • Source: https://github.com/objective-see/KnockKnock/tree/main/Plugins

• Endpoint Security Framework (ESF)

  • Apple ESF Event Types
  • Detection Engineering using Apple’s Endpoint Security Framework by Richie Cyrus
  • Taking The macOS Endpoint Security Framework For A Quick Spin by Cedric Owens
  • Objective-See (Patrick Wardle)
    • Process & File Monitor

• Kinga Kieczkowska (@kieczkowska)

  • Notification Center Forensics
  • Air Drop Forensics
    • Part 1
    • Part 2

• Tooling

  • mac_apt - macOS (and iOS) Artifact Parsing Tool by Yogesh Khatri
  • AutoMacTC: Automated Mac Forensic Triage Collector by CrowdStrike

• Books

  • OS X Incident Response Scripting and Analysis by Jaron Bradley