macOS is not inherently secure. It is inherently less targeted, which is not the same thing. As organizations shift to macOS-heavy fleets (especially in engineering and development), the attack surface follows. A compromised developer MacBook often has more sensitive access than a compromised corporate Windows endpoint: SSH keys to production servers, AWS credentials in ~/.aws/credentials, GitHub tokens in ~/.gitconfig, Docker contexts pointing to production clusters, and Keychain entries for every internal service.

The detection gap is real. Most SOCs have deep Windows telemetry (Sysmon, Event Logs, EDR) and minimal macOS visibility. The macOS Unified Log is verbose but poorly understood. Apple's Endpoint Security API provides process execution, file access, and network events, but many EDR vendors still have weaker macOS coverage than Windows. Hunting on macOS requires different tools, different queries, and different instincts.

1. 1. Hunt for Keychain credential dumping The macOS Keychain stores passwords, API keys, certificates, and SSH passphrases. Attackers use tools like Chainbreaker or the built-in security find-generic-password command to dump stored credentials. Search for: non-system binaries executing security find-generic-password or security dump-keychain, and any process accessing Keychain database files directly. ES API: process exec of "security" with args containing find-generic-password · Unified Log
2. 2. Hunt for local credential file access Developers store sensitive credentials in predictable locations. Monitor for unauthorized reads of: ~/.ssh/ (SSH keys and config), ~/.aws/credentials and ~/.aws/config (AWS access keys), ~/.gitconfig and ~/.git-credentials (GitHub/GitLab tokens), ~/.docker/config.json (container registry creds), and ~/.kube/config (Kubernetes cluster access). Any process reading these files that isn't the expected application is suspicious. ES API: file open events on credential paths · Falco for macOS · osquery FIM
3. 3. Hunt for TCC bypasses Transparency, Consent, and Control (TCC) governs which apps can access camera, microphone, full disk, and other protected resources. Attackers bypass TCC by injecting code into apps that already have TCC permissions (Terminal, VS Code, Slack) to inherit their grants. Search for: dylib injection into TCC-trusted apps, unexpected code signing changes, and processes accessing TCC-protected resources without a corresponding user prompt. ES API: process exec with TCC-protected resource access · tccutil audit · TCC.db query
4. 4. Hunt for persistence mechanisms macOS persistence is different from Windows. Search for: LaunchAgents and LaunchDaemons in ~/Library/LaunchAgents/, /Library/LaunchAgents/, /Library/LaunchDaemons/ (new plists), Login Items modifications, cron jobs (crontab -l), at jobs, and Finder Sync extensions. Any new LaunchAgent or LaunchDaemon plist created outside managed software deployment is suspicious. osquery: SELECT * FROM launchd WHERE path NOT IN [approved list] · FIM on LaunchAgents/
5. 5. Check for trojanized developer tools Lazarus specifically targets developers with trojanized applications: fake trading platforms (AppleJeus), malicious npm/pip packages, and backdoored developer utilities. Search for: recently installed applications not from the App Store or your MDM, applications with invalid or ad-hoc code signatures, and npm/pip packages that execute post-install scripts with network activity. Lazarus playbook · MDM app inventory · codesign -v verification
6. 6. Monitor for process injection and dylib hijacking Attackers inject malicious dynamic libraries (dylibs) into running processes or exploit dylib search order to load malicious code. Search for: DYLD_INSERT_LIBRARIES environment variable set on process launch, dylibs loaded from non-standard paths, and processes loading unsigned dylibs. ES API: dylib load events · Unified Log: dyld entries · DYLD_INSERT_LIBRARIES in env
7. 7. Audit outbound connections from developer tools Developer tools (IDE extensions, npm/pip, Docker, git) make legitimate outbound connections. The hunt: connections from these tools to destinations outside their expected set. A VS Code extension connecting to an unknown C2 server. An npm install triggering a reverse shell. Git cloning from an attacker-controlled repo that executes a post-checkout hook. Network monitoring: outbound from developer tool processes · Little Snitch / LuLu alerts

Apple Endpoint Security API. The macOS equivalent of ETW/Sysmon. Provides process execution, file access, network connections, and authorization events. Your EDR vendor's macOS agent should be consuming these events. If it isn't, you have no endpoint visibility on macOS.

Unified Log. Apple's centralized logging system. Verbose but powerful. Use log stream or log show for real-time and historical queries. Filter by subsystem (com.apple.securityd for Keychain, com.apple.TCC for TCC decisions).

osquery. Cross-platform host interrogation. Runs on macOS and provides SQL-queryable views of processes, LaunchAgents, Keychain entries, browser extensions, and file integrity. The most practical tool for fleet-wide macOS hunting.

Lazarus / HIDDEN COBRA (macOS developer targeting via AppleJeus and Operation DreamJob)
Infostealer Infection (credential harvesting from developer machines)
Supply Chain Indicator (trojanized developer tools and packages)
Cloud Control Plane (stolen AWS/GCP credentials from developer machines enable cloud compromise)