Analytics Story: MacOS Post-Exploitation

Created: 2026-04-14 Last Updated: 2026-05-13 ID: bae14f9c-929d-4e2b-8fe7-e4680e0edbbb Author: Raven Tait, Splunk Product: Splunk Enterprise Security

Description

This analytic story identifies popular MacOS post exploitation tools such as MacPEAS, MacShellSwift, EvilOSX, chainbreaker, etc

Why it matters

These tools allow operators find possible exploits or paths for privilege escalation based on stored credentials, user permissions, kernel version and distro version.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Socat Network Listener Binding an Executable	Command and Scripting Interpreter, Protocol Tunneling	TTP
MacOS Gatekeeper Bypass	Gatekeeper Bypass	Anomaly
MacOS LoginHook Persistence	Login Hook	TTP
MacOS Osascript Executing Interactive Shell	AppleScript, Unix Shell	Anomaly
MacOS AppleScript Shell Execution and Compilation	AppleScript	Anomaly
Socat Remote TCP Connection with Local Echo Disabled	Command and Scripting Interpreter, Protocol Tunneling	Anomaly
MacOS Log Removal	Indicator Removal	TTP
MacOS Osascript Executing JavaScript Code With ObjC	AppleScript, JavaScript	Anomaly
MacOS Data Chunking	Data Transfer Size Limits	Anomaly
Cisco NVM - Osascript Network Connection for a Long Duration	AppleScript, Web Protocols	Anomaly
MacOS Network Share Discovery	Network Share Discovery	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Osquery Results	Other	`osquery:results`	`osquery`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata:v2`	`not_applicable`

References

Source: GitHub | Version: 2