Skill: macOS Security Assessment

Supplementary Files:

• payloads.md — Command catalogue for macOS red team and malware analysis: 18 sections covering recon, SIP/TCC bypass, ESF event logging, LaunchAgents/Daemons persistence, Keychain extraction, Cookies.binarycookies, Apple Silicon (arm64e, PAC, sealed snapshots), MDM profile analysis, Mach-O analysis (otool, jtool2, machOView), code signing/notarization, process/memory analysis, network analysis, persistence enumeration, defense bypass (AMFI, sandbox), Objective-See tools (KnockKnock, LuLu, BlockBlock, OverSight), and a cheat sheet. 60+ code blocks with real macOS CLI syntax.
• test-cases.md — Structured test cases (TC-MO-001..018): system profiling, SIP status check, TCC.db audit, LaunchAgents/Daemons enumeration, Keychain extraction via security, Cookies.binarycookies parsing, MDM profile analysis, Mach-O analysis, code signing verification, KnockKnock persistence scan, ESF event logging, Apple Silicon PAC check, plus Apple Silicon boot chain, ESF client construction, TCC.db deep reverse engineering, MDM profile abuse, unified log hunting, AMSI/AMFI bypass, and Keychain offline cracking. Includes a Verification Checklist.
• guides/macos-security-playbook.md — End-to-end operational playbook: macOS security architecture (SIP/TCC/AMFI/sandbox/ESF/Secure Boot), Apple Silicon specifics (arm64e, PAC, Rosetta 2, sealed system snapshots), building a macOS test lab, red team methodology, real-world macOS threats (XCSpy, Shlayer, Bundlore, Silver Sparrow, NodeStealer), defense patterns, and references.
• guides/macos-security-deep-dive.md — Deep-dive on Apple Silicon (M1/M2/M3/M4) security architecture: boot chain (SSV/Rosetta/kernel), PPL (Page Protection Layer), pointer authentication codes, kext vs System Extensions, the Endpoint Security Framework API surface, TCC.db reverse engineering methodology, recent CVEs (CVE-2023-32434/32435/41990), and the macOS red team tradecraft playbook.

Summary

macOS security assessment skill covering Apple's desktop/laptop platform from a red team and malware analyst perspective. This skill addresses the modern macOS attack surface: System Integrity Protection (SIP/rootless), Transparency Consent and Control (TCC), Endpoint Security framework (ESF), Apple Silicon (M1/M2/M3/M4 with arm64e and Pointer Authentication Codes), T2 chip on Intel Macs, code signing + notarization enforcement, LaunchAgents/LaunchDaemons persistence, Keychain credential stores, MDM profile abuse, and Mach-O binary analysis.

Tools: Objective-See suite (KnockKnock, LuLu, BlockBlock, OverSight, TaskExplorer, What's Your Sign?), sindresorhus/Equity, mSCP (macOS Security Compliance Project), machOView, Hopper Disassembler, Ghidra (Mach-O plugin), jtool2, ldid, plus native CLI (system_profiler, csrutil, tccutil, security, codesign, otool, nm, vmmap, lldb, profiles, airport).

Domain: macos

MITRE ATT&CK: T1547-Boot or Logon Autostart (LaunchAgents/Daemons, login items), T1555-Credentials from Password Stores (Keychain, Cookies.binarycookies), T1059-Command and Scripting Interpreter (zsh, osascript), T1068-Exploitation for Privilege Escalation (SIP bypass, SUID abuse), T1106-Native API (Mach APIs, launchd), T1620-Reflective Code Loading (DYLD injection), TA0005-Defense Evasion (AMFI bypass, notarization abuse, TCC bypass).

Description

macOS is no longer a niche enterprise endpoint. As of 2026 it commands roughly a quarter of the U.S. enterprise laptop market, is the default developer machine at most Fortune 500 technology companies, and is increasingly the executive laptop of choice. It is also a strange target: it runs a Darwin/BSD core (so it has UNIX permissions, file flags, chroot, seatbelt sandbox profiles), but it is wrapped in a sophisticated proprietary security architecture (System Integrity Protection, Apple Mobile File Integrity / AMFI, TCC privacy consent, Secure Boot, sealed system snapshots on Apple Silicon, and the Endpoint Security framework). Most offensive techniques ported from Linux work, but the interesting bugs and persistence mechanisms are macOS-specific — and the defenders have a 10-year head start via Patrick Wardle's research, the Objective-See tooling, Apple's Platform Security Guide, and the macOS Security Compliance Project (mSCP).

This skill is the macOS counterpart to av-edr-evasion (which focuses on Windows Defender / commercial EDR) and binary-reverse (which is platform-agnostic but mostly ELF/PE-flavored). Where those skills cover Windows and Linux, this skill covers the macOS-specific attack surface: csrutil/nvram for SIP, tccutil + TCC.db for privacy, security CLI for Keychain, codesign/spctl for signing and notarization, otool -L and jtool2 for Mach-O introspection, profiles for MDM, and the EndpointSecurity framework for the same event stream that commercial EDR (Falcon, SentinelOne, Jamf Protect, Microsoft Defender for Endpoint) subscribes to.

Eight things distinguish macOS attacks from generic UNIX attacks:

1. SIP (System Integrity Protection) is the new root — On 2015+ macOS, even root cannot write to /System, /usr, /bin, /sbin, certain protected subdirs of /Library, or the TCC database by default. Processes that try must be Apple-signed with the right entitlements, or SIP itself must be disabled (recovery-mode csrutil disable). Modern macOS attacks either work within SIP (persistence in user-writable locations, TCC.db manipulation under granted entitlements) or seek SIP bypasses (CVE-2019-8805, CVE-2020-3837, CVE-2023-32434 — the latter a memory corruption in the boot ROM image parser, unpatchable by software on Apple Silicon).

2. TCC (Transparency, Consent, and Control) is the new permission gate — Every macOS app that wants to read user data (location, camera, microphone, contacts, calendars, reminders, photos, Mail, Safari history, Messages, full disk access, accessibility control, automation) must request consent at first use, recorded in /Library/Application Support/com.apple.TCC/TCC.db (system) and ~/Library/Application Support/com.apple.TCC/TCC.db (user). TCC bypass is the macOS analog of a Windows UAC bypass — historically via DYLD insertion into a TCC-entitled binary (Xcode.app, swift), via env-var abuse, or via direct SQLite manipulation when SIP is weakened.

3. The Endpoint Security framework (ESF) is the EDR's eyes — and yours — Introduced in macOS 10.15 Catalina (2019) and hardened repeatedly since, ESF is the only supported API for monitoring process exec, file writes, endpoint disk I/O, mount/unmount, opendirectory lookups, and (on Monterey+) login/logout. Commercial EDR (CrowdStrike, SentinelOne, Defender for Endpoint, Jamf Protect) is required by Apple to subscribe to ESF — and a red team operator who can run eslogger or build their own ESF client gets the same telemetry, for free, on any Mac they have admin on.

4. Apple Silicon changes the rules — PAC, sealed snapshots, Rosetta 2 — On M-series Macs, the kernel runs arm64e with Pointer Authentication Codes (PAC) on every function pointer and return address — most classic ROP/JOP chains fail. The system volume is a cryptographically sealed APFS snapshot (/System/Volumes/Data is mutable, ///System are read-only and hash-checked at every boot). Kernel extensions are effectively dead for third parties; the only supported path is System Extensions (user-land) and DriverKit. Rosetta 2 (x86_64 emulation) is an entire second ABI with its own historical bugs (CVE-2021-30717 — Rosetta translation bypass of code signing checks). Apple Silicon also brought Silver Sparrow (2021), the first malware family observed shipping an arm64 payload alongside x86_64.

5. Code signing and notarization are mandatory, but gameable — On macOS 10.15+ the Gatekeeper default rejects any downloaded binary that isn't signed by a Developer ID and notarized by Apple. But ad-hoc signed binaries (signed locally with codesign -s -) execute fine if run from a path that bypasses Gatekeeper (anything not quarantined — e.g., extracted from an installer, run by a binary that already has the same permissions). And historically notarization was bypassed via signed-and-notarized "conduit" binaries (the classic Shlayer model: a notarized dropper that fetches and unpacks the actual payload at runtime).

6. LaunchAgents and LaunchDaemons are the persistence layer — The single most abused macOS persistence mechanism is ~/Library/LaunchAgents/<bundle-id>.plist (user) and /Library/LaunchDaemons/<bundle-id>.plist (system). Each plist tells launchd (PID 1) to spawn a binary on a schedule, on login, on network change, or on a watched path. KnockKnock enumerates ~50 of these locations. macOS malware (Bundlore, Shlayer, XCSpy, CoinMiner) almost always adds a LaunchAgent. There are also login items (~/Library/Application Support/com.apple.backgroundtaskmanagementagent/), Spotlight importers, QuickLook plugins, Internet plug-ins, browser extensions, and the legacy /etc/periodic/ and crontab.

7. Keychain and Cookies.binarycookies are the credential prize — macOS stores user secrets in ~/Library/Keychains/login.keychain-db (user) and /Library/Keychains/System.keychain (system): Safari passwords, Wi-Fi PSKs, application tokens, certificates. The security CLI can dump it after prompting for the user's login password (or with no prompt if the calling binary is signed and entitled), and KeychainDump/chainbreaker extract password hashes for offline cracking. Safari cookies live in ~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies — a non-standard binary plist format that several tools parse.

8. MDM is the enterprise control plane — and a target — macOS in enterprise is typically enrolled in Mobile Device Management (Jamf, Kandji, Microsoft Intune, Workspace ONE). MDM profiles can push restrictions, configure FileVault, deploy System Extensions, and remotely wipe. The profiles CLI lists installed profiles and can install new ones (with admin). MDM profile abuse includes: extracting an enrollment identity from a compromised host to enroll rogue devices, bypassing MDM via beta OS profiles, or exploiting profile signing weaknesses. Apple's Platform Security Guide treats the MDM as a privileged trust boundary.

Difference from mobile-security: mobile-security is iOS/Android — app review bypass, certificate pinning, APK/IPA reverse engineering, mobile data protection at the application layer. THIS skill is macOS desktop/laptop specifically — SIP/TCC/ESF, LaunchAgents/Daemons persistence, Mach-O (not ELF/PE), Keychain (not Android Keystore), MDM profile analysis as an enterprise control plane. The platforms share a kernel (Darwin) and code signing (codesign + ldid) but the attack surfaces are otherwise distinct. iOS additionally has its own sandbox and entitlement system that differs in detail.

Difference from av-edr-evasion: av-edr-evasion covers Windows Defender, commercial EDR (CrowdStrike, SentinelOne, Defender for Endpoint), and bypass techniques for those. THIS skill covers the macOS-specific defense stack: AMFI, Gatekeeper, XProtect, MRT (Malware Removal Tool), TCC, and the macOS-native EDR surface (System Extensions, ESF). Where av-edr-evasion might cover direct syscalls and process doppelgänging on Windows, this skill covers signed-and-notarized droppers, TCC bypass via entitlement inheritance, and persistence in LaunchAgents.

Difference from binary-reverse: binary-reverse covers static/dynamic analysis broadly — PE, ELF, and Mach-O. THIS skill narrows to Mach-O specifically: otool, nm, jtool2, machOView, Ghidra Mach-O plugin, disassembling arm64/arm64e with PAC-aware tooling, dumping entitlements, walking the load commands. The Mach-O format, the Objective-C runtime metadata, and the Swift symbol mangling are macOS-specific.

Difference from digital-forensics: digital-forensics covers IR artifacts broadly (logs, file system timeline, memory). THIS skill covers macOS-specific forensic artifacts: the unified log (log show), FSEvents, Spotlight metadata, TCC.db audit, Keychain access history, Spotlight importers, and the securenotes table in the user keychain. Where digital-forensics might describe Windows event log analysis, this skill covers log show --predicate 'subsystem == "com.apple.securityd"'.

Difference from container-security and cloud-security: those cover Linux containers and cloud IaaS. macOS has its own containerization model (per-app sandbox via sandboxd, hardened runtime via entitlements, App Sandbox container directories at ~/Library/Containers/<bundle-id>/). The macOS container model is per-process and enforced by the kernel, not by a container runtime.

Use Cases

• SIP/TCC bypass for red team: Identify the running SIP configuration (csrutil status), enumerate the TCC-protected resources the foothold user can access, look for entitlement-rich binaries (Xcode, Mail, Safari) that can be used as proxies via DYLD insertion or osascript automation, and document paths to bypass TCC where present.
• Keychain, cookies, and Safari data extraction: Once on a Mac with the user logged in, dump ~/Library/Keychains/login.keychain-db via the security CLI, extract Safari cookies from Cookies.binarycookies, parse Safari history from History.db, and recover saved Wi-Fi PSKs via security find-generic-password.
• MDM profile analysis and abuse: Enumerate installed configuration profiles (profiles list -output user), reverse-engineer the payload of each profile to find enterprise restrictions, identify the MDM vendor, locate the enrollment identity, and document paths to MDM bypass (DEP re-enrollment race, beta OS profile, supervised-mode downgrade).
• Persistence via LaunchAgents/Daemons: Install a LaunchAgent plist in ~/Library/LaunchAgents/ (user scope) or /Library/LaunchDaemons/ (system scope, requires root), enumerate competing persistence via KnockKnock, and identify the 50+ persistence locations macOS exposes (login items, Spotlight importers, QuickLook, browser extensions, loginwindow hooks).
• macOS-native malware analysis: Take an unknown Mach-O binary, identify its architecture (file, otool -h), enumerate load commands and linked libraries (otool -L, jtool2 -l), dump entitlements (codesign -d --entitlements -), walk the Objective-C class metadata (otool -ov), disassemble in Hopper/Ghidra, and trace its behavior with fs_usage, opensnoop, dtrace, and an ESF logger.
• Apple Silicon-specific attacks: On M-series Macs, detect PAC enforcement (sysctl kern.bootargs), inspect the sealed system snapshot (mount, csrutil authenticated-root status), test for Rosetta 2 escape paths, and reason about the absence of classic kext-based persistence (System Extensions are user-land).
• Endpoint Security framework instrumentation: Build a minimal ESF client (or use eslogger / esf-client) to subscribe to process-exec, file-write, and login events, and produce a process-tree timeline of attacker behavior on a target Mac — useful both as an attacker (knowing what the defender sees) and a defender (operationalizing ESF for free).
• macOS incident response and threat hunting: Parse the unified log for security-relevant events (log show --predicate 'subsystem == "com.apple.securityd"'), audit TCC.db for unexpected grants, scan all LaunchAgents/Daemons with KnockKnock, list installed System Extensions (systemextensionsctl list), and triage a suspect Mach-O binary with What's Your Sign? and TaskExplorer.

Core Tools

Objective-See Suite (free, open-source, the de facto standard)

Tool	Purpose	Command Example
KnockKnock	Enumerate ~50 macOS persistence locations (LaunchAgents, LaunchDaemons, login items, browser extensions, Spotlight importers, kernel extensions, System Extensions)	KnockKnock.app/Contents/MacOS/KnockKnock -h (or click "Scan")
LuLu	Free open-source macOS firewall — block outbound by bundle ID / binary path	sudo /Objects/LuLu.app/Contents/MacOS/LuLu (mode 2 = block-by-default)
BlockBlock	Persistence monitor — alerts when anything installs a LaunchAgent, login item, or kernel extension	BlockBlock.app (GUI monitor)
OverSight	Camera + microphone monitor — alerts when an app accesses the camera or mic	OverSight.app
TaskExplorer	Process explorer with code-signing info, VT lookups, file/path context	TaskExplorer.app
What's Your Sign?	Finder extension showing code-signing details (cert chain, notarization status)	Right-click → Services → What's Your Sign?

Analysis + Compliance

Tool	Purpose	Command Example
sindresorhus/Equity	Open-source Gatekeeper / notarization / TCC GUI inspector	Equity.app (drag-drop a binary to see signing/notarization details)
mSCP (macOS Security Compliance Project)	NIST + Apple baseline configuration profiles + audit scripts	python3 bin/mSCP.py -s baseline/macos_15_1.yaml
machOView	GUI Mach-O browser — load commands, segments, sections, Objective-C classes	machOView.app (open a Mach-O binary)
Hopper Disassembler	Native macOS disassembler/decompiler (commercial, with demo)	hopper <binary>
Ghidra (Mach-O plugin)	NSA's open-source reverse-engineering suite with Mach-O loader	analyzeHeadless . proj -import <binary>
jtool2	The Swiss-army knife for Mach-O introspection (by Elias Limneos) — replaces many otool workflows	jtool2 -l <binary> (load commands); jtool2 -arch arm64e -L <fat>
ldid	Alternative to codesign for ad-hoc signing with entitlements (Cydia/Telesphoreo origin)	ldid -S<entitlements.plist> <binary>

Methodology

macOS Red Team Five-Phase Workflow

Phase 1          Phase 2          Phase 3          Phase 4          Phase 5
Recon &       →  Privilege &   →  Persistence   →  Credential     →  Defense Bypass
Footold          TCC Posture      (LaunchAgents)    Extraction       & ESF Audit
   │                │                │                │                │
   ▼                ▼                ▼                ▼                ▼
 system_profiler   csrutil status   ~/Library/       security         AMFI bypass,
 sw_vers, uname    tccutil reset    LaunchAgents/     dump-keychain   sandbox profile
 hardware arch     TCC.db audit     LaunchDaemons/    Cookies.        escapes, notarization
 loginwindow       accessibility    login items       binarycookies   conduit abuse,
 MDM profiles      Full Disk Acc    Spotlight imp.    Safari          ESF self-audit
                                                                    via eslogger

Phase 1: Recon & Foothold — Determine the macOS version (sw_vers), hardware architecture (uname -m → arm64/arm64e for Apple Silicon, x86_64 for Intel), system model (system_profiler SPHardwareDataType), FileVault status (fdesetup status), and the user's full name + UID + admin group membership (id, groups). Enumerate installed MDM profiles (profiles list -output user) and the MDM vendor. Identify what security software is running (Look for falcon, sentinelone, jamfProtect, Microsoft Defender processes). Establish a foothold via the engagement scope (existing user creds, a delivered payload, a browser exploit).

Phase 2: Privilege & TCC Posture — Determine SIP status (csrutil status), TCC state (tccutil reset All clears — but only as user; system TCC.db requires root + SIP weakened), and the current process's own TCC grants (via the tccutil reads or by parsing ~/Library/Application Support/com.apple.TCC/TCC.db). Identify entitlement-rich binaries that grant indirect TCC access: Xcode (com.apple.dt.Xcode), Safari (com.apple.Safari), Mail (com.apple.Mail), Terminal with Full Disk Access already granted. Document which TCC-protected resources the user has already granted (the easiest path to credentials and history).

Phase 3: Persistence — Install a LaunchAgent at ~/Library/LaunchAgents/com.example.helper.plist (user scope, runs at user login) or ~/Library/LaunchDaemons/com.example.helper.plist (system scope, runs at boot, requires root + sudo). For wider persistence, consider: login items via LSSharedFileListInsertItemURL, Spotlight importers (~/Library/Spotlight/), QuickLook plugins (~/Library/QuickLook/), browser extensions (~/Library/Application Support/Google/Chrome/Default/Extensions/), the legacy /etc/periodic/daily/ dropboxes, and cron. On Apple Silicon, all of these work — kernel extensions do not.

Phase 4: Credential Extraction — Dump the login keychain via security dump-keychain -d ~/Library/Keychains/login.keychain-db (prompts for user password), enumerate generic passwords (security find-generic-password -l), extract saved Wi-Fi PSKs (security find-generic-password -ga "SSID" -w), parse Safari cookies from ~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies (use binarycookies-reader or python script), and read Safari history from ~/Library/Safari/History.db (Full Disk Access required). Document each credential source and the TCC entitlement required to reach it.

Phase 5: Defense Bypass & ESF Audit — Identify what the defender sees: run eslogger (or build an ESF client) and observe your own actions; understand that ESF is the same data commercial EDR uses. If a specific defender (Falcon, Defender for Endpoint) is running, identify its ESF subscription and any network callouts it makes. Document anti-analysis: AMFI (amfid) checks every exec against the trust cache; sandbox profiles restrict syscalls; Gatekeeper enforces notarization on quarantined files. Document bypasses used: running from non-quarantined paths (no com.apple.quarantine extended attribute), DYLD insertion into TCC-entitled binaries (when SIP permits), entitlement inheritance via signed-and-notarized conduits.

Quick Selection Guide