Vendor
macOS SIP Bypass via Sandboxing Abuse
2 rules 2 TTPsA macOS vulnerability enables bypassing System Integrity Protection (SIP) by abusing sandboxing mechanisms to load an untrusted library into a SIP-entitled process.
Comprehensive Analysis of Mac Malware in 2017
3 rules 6 TTPsA comprehensive analysis of Mac malware discovered in 2017, detailing infection vectors, persistence mechanisms, features, and goals, including FruitFly, MacDownloader (iKitten), and others.
macOS Local Privilege Escalation via Dylib Hijacking in App Store Applications
3 rules 2 TTPsA local privilege escalation vulnerability in macOS allows attackers to gain root privileges by hijacking dylibs in applications installed from the Mac App Store.
macOS Kernel-to-Userland Process Creation Notification via undocumented kev_msg_post
2 rulesThe kev_msg_post function can be abused by malware to broadcast process creation notifications from a kernel extension (kext) to a user-mode application, potentially bypassing security tools that rely on standard APIs and leading to undetected malicious activity.
macOS File Monitoring via Endpoint Security Framework
2 rules 1 TTPObjective-See details how to create a file monitor for macOS 10.15 using Apple's Endpoint Security Framework to capture file I/O events and process information.