macOS: Unauthorized screensaver configuration modification

Adversaries can establish persistence on macOS by deploying a malicious screensaver (.saver) bundle and modifying the associated screensaver preference (plist) files. This forces the system to execute the malicious bundle whenever the screensaver activates. Detection focuses on identifying modifications to com.apple.screensaver.*.plist files performed by unsigned, untrusted, or common script-based processes.

Attack Chain

1. Attacker gains initial access to the macOS host.
2. Attacker writes a malicious screensaver (.saver) bundle to a directory such as ~/Library/Screen Savers/.
3. Attacker uses an untrusted process or script interpreter (e.g., python, osascript, perl) to modify the screensaver preference plist.
4. The system, upon user inactivity or manual activation, triggers the ScreenSaverEngine.
5. The screensaver engine loads the malicious .saver bundle.
6. The malicious bundle executes arbitrary code under the context of the active user session.

Recommendation

• Deploy the provided detection logic to identify unauthorized modifications to screensaver preferences.
• Investigate any process modifying com.apple.screensaver.*.plist files that lacks a valid code signature or is a known script interpreter.
• Review the contents of ~/Library/Screen Savers/ and /Library/Screen Savers/ for unexpected or unsigned .saver bundles.
• Verify that legitimate device management solutions or administrative scripts interacting with plist files are properly signed and identified as authorized.