The Diana Initiative 2021

Knowing what malicious activity looks like in macOS and developing viable detection in an enterprise environment are separate challenges. Detections that seem simple at first glance, like applications spawning shell commands, are often frustrated by shortcuts used by legitimate software products. Other detections, like identifying malicious cron jobs, are complicated by user behavior. Additionally, enterprise endpoint detection tools are not always macOS-aware. Just because your EDR runs on a macOS machine doesn’t mean the EDR understands the internals of macOS, and what artifacts are significant.



This presentation will focus on strategies for developing macOS alerts within enterprise environments, and what lessons can be carried forward if you already familiar with detection on Windows endpoints.