Skip to content

Snap Mac Detections#3935

Merged
patel-bhavin merged 10 commits intodevelopfrom
mac_from_snap
Apr 14, 2026
Merged

Snap Mac Detections#3935
patel-bhavin merged 10 commits intodevelopfrom
mac_from_snap

Conversation

@RavenTait
Copy link
Copy Markdown
Contributor

Added new Mac OS detections and analytic stories

Detections:

  • MacOS Account Created
  • MacOS Data Chunking
  • MacOS Gatekeeper Bypass
  • MacOS Hidden Files and Directories
  • MacOS Kextload Usage
  • MacOS Keychains Dumped
  • MacOS Log Removal
  • MacOS Loginhook Persistence
  • MacOS Network Share Discovery

Stories

  • MacOS Post-Exploitation
  • MacOS Persistence Techniques
  • MacOS Privilege Escalation

@RavenTait RavenTait added the WIP DO NOT MERGE Work in Progress label Mar 3, 2026
@nasbench nasbench added this to the v5.25.0 milestone Mar 16, 2026
@nasbench
Copy link
Copy Markdown
Contributor

Moving this to v5.25.0 since the TA missed out on this release.

Comment thread detections/endpoint/macos_account_created.yml Outdated
Comment thread detections/endpoint/macos_account_created.yml Outdated
Comment thread detections/endpoint/macos_account_created.yml Outdated
Comment thread detections/endpoint/macos_data_chunking.yml Outdated
@patel-bhavin patel-bhavin modified the milestones: v5.25.0, v5.26.0 Mar 31, 2026
@nasbench
Copy link
Copy Markdown
Contributor

Added the OSquery TA. So now unit testing should pass if the searches are accurate. This PR is now targeting 5.26

Comment thread detections/endpoint/macos_account_created.yml Outdated
@nasbench
Copy link
Copy Markdown
Contributor

FYI. My review is in progress

Copy link
Copy Markdown
Contributor

@nasbench nasbench left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall LGTM just some minor metadata updates like RBA stuff, references and some logic suggestions/questions

Comment thread detections/endpoint/macos_account_created.yml Outdated
Comment thread detections/endpoint/macos_account_created.yml Outdated
Comment thread detections/endpoint/macos_account_created.yml
Comment thread detections/endpoint/macos_account_created.yml Outdated
Comment thread detections/endpoint/macos_account_created.yml Outdated
Comment thread detections/endpoint/macos_network_share_discovery.yml
Comment thread detections/endpoint/macos_network_share_discovery.yml Outdated
Comment thread stories/macos_persistence_techniques.yml Outdated
Comment thread stories/macos_post_exploitation.yml Outdated
Comment thread stories/macos_privilege_escalation.yml Outdated
@nasbench nasbench removed the WIP DO NOT MERGE Work in Progress label Apr 13, 2026
Copy link
Copy Markdown
Contributor

@nasbench nasbench left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@patel-bhavin patel-bhavin merged commit 8050483 into develop Apr 14, 2026
6 checks passed
@patel-bhavin patel-bhavin deleted the mac_from_snap branch April 14, 2026 14:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants