macOS Defend

macOS Defend#

DFIR triage on macOS hosts. The operator chains volatility-ordered collection, malware reversing primitives, and a long list of artifact locations spanning system logs, user preferences, browsers, and mail.

Order of volatility (RFC 3227)#

Registers, cache.
Routing table, ARP cache, process table, kernel statistics, memory.
Temporary file systems.
Disk.
Remote logging and monitoring data.
Physical configuration, network topology.
Archival media.

Forensic, defensive tools#

Venator, macOS tool for proactive detection. https://github.com/richiercyrus/Venator
Google Santa, binary whitelisting / blacklisting for macOS. https://github.com/google/santa
KnockKnock, see what is persistently installed on the Mac to generically reveal malware. https://objective-see.com/products.html
LuLu, free firewall to protect network connections and detect malicious activity. https://objective-see.com/products.html
BlockBlock, continual monitoring of persistence locations. https://objective-see.com/products.html
Netiquette, network monitor, explores all sockets and connections. https://objective-see.com/products.html
mac_apt, DFIR tool to process Mac full disk images or live machines and extract forensic data. https://github.com/ydkhatri/mac_apt
OSXCollector, collection script that produces a JSON file describing the machine (plists, SQLite DBs, file system). https://github.com/Yelp/OSXCollector

Reversing macOS#

Install Apple command-line tools, then drive the binaries with the following utilities.

strings    string decoder
file, nm, xattr, mdls       file analysis utilities
hexdump, od, xxd            hex editors
otool      static disassembler
lldb       debugger, memory reader, dynamic disassembler

Recipes.

# File type
$ file malware_file
$ xattr -l malware_file
$ ls -al@ malware_file

# If signed, check _CodeSignature for IoCs (TeamIdentifier, Bundle ID)
$ codesign -dvvvv -r - malware_file.app/

# Is the cert still valid?
$ spctl --verbose=4 --assess --type execute malware_file.app

# Application bundle enumeration
$ putil -p malware_file.app/Contents/Info.plist

# Pagestuff and nm for internal structure
$ nm -m malware_file.app/MacOS/malware_file
$ pagestuff malware_file.app/MacOS/malware_file -a

# Dump strings
$ strings - malware_file > malwareStrings.txt

# otool, shared library links, method names, disassembly
$ otool -L malware_file > malwareLibs.txt
$ otool -oV malware_file > malwareMethods.txt
$ otool -tV malware_file > malwareDisassembly.txt

macOS misc#

$ logs show > logs.txt
$ sudo logs collect <time> --output <file>

Artifact locations#

Autorun.

/Library/LaunchAgents/*
/System/Library/LaunchAgents/*
%%users.homedir%%/Library/LaunchAgents/*
/Library/LaunchDaemons/*
/System/Library/LaunchDaemons/*
/Library/StartupItems/*
/System/Library/StartupItems/*

System logs.

/var/log/*                System log files
/var/log/asl/*            Apple System Log
/var/audit/*              Audit log
/var/log/install.log      Installation log
/var/log/wtmp, /var/log/utmp, /var/log/lastlog
/var/run/utmpx
/var/db/diagnostics/*.tracev3        Apple Unified Logging
/var/db/diagnostics/*/*.tracev3
/var/db/uuidtext/*/*

System preferences.

/Library/Preferences/**
/Library/Preferences/.GlobalPreferences.plist
/Library/Preferences/com.apple.loginwindow.plist
/Library/Preferences/com.apple.Bluetooth.plist
/Library/Preferences/com.apple.TimeMachine.plist
/Library/Preferences/com.apple.HIToolbox.plist
/Library/Preferences/SystemConfiguration/preferences.plist

System info.

/var/db/.AppleSetupDone                                 OS install time
/System/Library/CoreServices/SystemVersion.plist        OS name / version
/var/db/dslocal/nodes/Default/users/*.plist             local user password hashes

Sleep, swap, kernel extensions.

/var/vm/sleepimage
/var/vm/swapfile#
/System/Library/Extensions/*
/Library/Extensions/*

Software installation, system info, periodics.

/Library/Receipts/InstallHistory.plist
/Library/Preferences/com.apple.SoftwareUpdate.plist
/etc/localtime
/usr/lib/cron/jobs/*
/etc/crontab
/usr/lib/cron/tabs/*
/etc/defaults/periodic.conf, /etc/periodic.conf, /etc/periodic.conf.local
/etc/periodic/**2, /usr/local/etc/periodic/**2
/etc/daily.local/*, /etc/weekly.local/*, /etc/monthly.local/*
/etc/periodic/daily/*, /etc/periodic/weekly/*, /etc/periodic/monthly/*

Networking, user artifacts.

/etc/hosts
/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
%%users.homedir%%/Library/Preferences/com.apple.loginitems.plist
/Users/*

User directories.

%%users.homedir%%/Downloads/*
%%users.homedir%%/Documents/*
%%users.homedir%%/Music/*
%%users.homedir%%/Desktop/*
%%users.homedir%%/Library/*
%%users.homedir%%/Movies/*
%%users.homedir%%/Pictures/*
%%users.homedir%%/Public/*
/Applications/*

User preferences and logs (selected).

%%users.homedir%%/Library/Preferences/*
%%users.homedir%%/Library/Preferences/MobileMeAccounts.plist        iCloud
%%users.homedir%%/Library/Preferences/com.apple.sidebarlists.plist
%%users.homedir%%/Library/Preferences/.GlobalPreferences.plist
%%users.homedir%%/Library/Preferences/com.apple.Dock.plist
%%users.homedir%%/Library/Preferences/com.apple.iPod.plist          attached iDevices
%%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEvents
%%users.homedir%%/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
%%users.homedir%%/Library/Logs/*
%%users.homedir%%/.bash_history, %%users.homedir%%/.bash_sessions/*

iDevice backups.

%%users.homedir%%/Library/Application Support/MobileSync/Backup/*
    /info.plist, /Manifest.plist, /Manifest.mbdb, /Status.plist