macOS on-disk forensics #

macOS forensics is fundamentally different from Windows: there's no equivalent of the Windows Registry - settings live in thousands of plist (property list) files, and system behavior is logged through the Unified Log, a single structured firehose that replaced syslog/ASL in Sierra (10.12). Most high-value evidence lives in SQLite databases scattered under ~/Library/ and /private/var/db/. Three macOS-specific guardrails shape what attackers can do: SIP (System Integrity Protection) locks down system paths and strips dangerous env vars, Gatekeeper enforces code signing/notarization, and TCC (Transparency, Consent, and Control) gates access to private data (camera, mic, Full Disk Access, Downloads, etc.) via per-app consent prompts stored in TCC.db.

Logs & telemetry

The Unified Log is the backbone of macOS observability, one binary tracestore shared across kernel, launchd, apps, and security subsystems. It's compressed, structured, filterable by predicate language, and rotates fast (default retention is often only days on busy systems), so collecting a .logarchive is a first-24h priority. Supplement it with the per-service text logs (install.log, system.log) and the sysdiagnose bundle, which snapshots system state (process list, netstat, kextstat, powermetrics, running tasks) plus logs into a single tarball.

• Unified Log - all system logs; log collect --output /tmp/mac.logarchive, then log show --archive /tmp/mac.logarchive --predicate '…' --info --debug --last 7d. Default log show hides info and debug level entries - attackers know this and useful breadcrumbs often live there, so always pass --info --debug. ts: entries store wall-clock timestamps in Mach continuous time internally (ns since boot, like Linux monotonic) + a derived wall-clock. log show output is system local time by default - pass --timezone UTC or use --style ndjson for ISO-8601 UTC. Retention is file-rolling: Persist tracev3 files roll by size; busy systems may retain only 1-7 days. Tools: log (built-in), UnifiedLogReader (mandiant), macos-UnifiedLogs (Mandiant Rust port), Console.app
• sysdiagnose - sudo sysdiagnose (or ⌃⌥⇧⌘.) - comprehensive triage bundle incl. logs, netstat, kextstat. ts: bundle filename contains the capture timestamp (sysdiagnose_YYYY.MM.DD_HH-MM-SS<TZ>_<model>.tar.gz) and each embedded log carries its native ts. Tools: sysdiagnose-apollo, mac_apt parses the bundle
• Install.log - /var/log/install.log - package installs incl. PKG payloads. ts: each line prefixed with MMM DD HH:MM:SS<±hhmm>, includes TZ offset (unlike Linux syslog). Rotates infrequently; retention measured in months. Tools: grep, mac_apt, aftermath
• system.log + DiagnosticReports - crashes may reveal payload names. ts: system.log is RFC3339 with TZ offset. Crash reports (~/Library/Logs/DiagnosticReports/*.ips or legacy .crash) have Date/Time header + Launch Time + per-stack-frame timestamps in Mach continuous time. Tools: mac_apt, Spindump viewer
• Endpoint Security Framework (ESF) - eslogger (Big Sur+) prints ES events live; the API that Falcon / Jamf Protect / Red Canary / etc. ride. ts: each ES event has a mach_time (continuous ns) and a time (timespec, seconds + ns UTC). Live-only unless you record it; retention is whatever your EDR/collector keeps. Tools: eslogger, Objective-See's ESFPlayground, Red Canary macOS ES utilities
• Spindump - hang/high-CPU snapshot; useful for stealth miners. ts: report header has Date/Time (local w/ TZ) and End time; stack samples carry per-sample continuous-time offsets. Tools: spindump, Instruments.app

User-activity & filesystem artifacts

These are the "pattern-of-life" sources - what the user ran, when they ran it, what they downloaded, and what the filesystem changed. KnowledgeC and the related biome/DuetKnowledge stores are macOS's hidden crown jewel: a per-user SQLite timeline of app focus, Safari URLs, notifications, Bluetooth pairings, device plug-ins, generated passively by the CoreDuet daemon and often retained for weeks. FSEvents gives you volume-level file change history (not perfect - journal only, no content), Spotlight gives you rich per-file metadata, and the quarantine database + xattr ties downloaded files back to the originating URL and user agent. For TCC, remember: a new entry in TCC.db created outside of a normal consent prompt (e.g., written by root while SIP was disabled, or inherited via com.apple.rootless.install) is a very loud signal.

AI agent artifacts

AI coding agents and assistants run commands, read files and edit code as the user, so their transcripts are often the best execution log on the host - the prompt, every command, and the output the agent saw. The same files collect any secrets the agent read. Paths below are for macOS; ~ = /Users/<user>.

What to look for in the transcripts:

• Commands it ran - timeline every shell tool call next to EDR process events.
• Secrets it read - .env, cloud credential files, SSH keys, kube configs, browser profiles. What was read is in the transcript, so the transcript is now a copy of the secret.
• Where data went - web fetches, curl, git push to unfamiliar remotes, new MCP servers pointing at external URLs.
• Safety switches off - --dangerously-skip-permissions, --yolo, --trust-all-tools, broad allow rules, auto-approve. Check the settings file's mtime against the incident window.
• Instructions the user didn't write - prompt injection arrives in tool output (a web page, issue, README or MCP response). Read the tool results just before an odd action.
• Persistence - a planted CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules, hook or MCP server re-runs the attacker's instructions every session.
• Agents driven by malware - the August 2025 Nx "s1ngularity" npm compromise ran claude, gemini and q with permission checks off to hunt for secrets. The parent is a package script, not a terminal, and there's no matching user prompt. Record agent and extension versions too: a poisoned Amazon Q VS Code release (1.84.0, July 2025) shipped a wipe prompt.

Inventory (then copy; take SQLite files with their -wal / -shm files, or close the app first - recent rows often live only in the WAL. Check that your KAPE / Velociraptor / UAC targets actually cover these folders):

for h in /Users/* /var/root; do
  for t in .claude .claude.json .codex .gemini .copilot .continue .cursor .codeium .kiro .aws/amazonq .ollama .lmstudio \
           "Library/Application Support/Claude" "Library/Logs/Claude" "Library/Application Support/com.openai.chat" \
           "Library/Application Support/Code/User" "Library/Application Support/Cursor/User" "Library/Application Support/Windsurf/User"; do
    [ -e "$h/$t" ] && ls -ld "$h/$t"
  done
done 2>/dev/null
find /Users -name .aider.chat.history.md 2>/dev/null

Persistence on macOS

macOS persistence is plist-heavy and launchd-centric - virtually every "run my thing at boot or login" path routes through launchd, Apple's unified init/service manager, which reads .plist job definitions from a handful of well-known directories. Since Ventura (13) the single most important sweep is BTM (Background Task Management): sfltool dumpbtm enumerates every LaunchAgent, LaunchDaemon, Login Item, and launch-time dylib the system knows about, and the user receives a notification when a new persistence item is installed, which attackers now actively work around by dropping items that masquerade as Apple/MDM entries, or by abusing SIP-protected directories where BTM trusts the publisher. Everything below assumes you've already pulled a BTM dump.

launchd - the dominant persistence surface

• User LaunchAgents - ~/Library/LaunchAgents/*.plist. Runs as the logged-in user, loaded at that user's login (Aqua session). No admin required to write, which is why it's the single most common macOS persistence path for commodity malware and infostealers. The plist specifies a Label, ProgramArguments (what to run), and triggers like RunAtLoad, KeepAlive, StartInterval, or WatchPaths. Triage: diff against a clean install, inspect every ProgramArguments value, hunt for Apple-lookalike Labels like com.apple.updateagent.
• System LaunchAgents - /Library/LaunchAgents/*.plist. Same semantics but applies to all users on the box; requires admin. Common MDM-pushed path; abuse looks like a signed-but-malicious vendor plist.
• LaunchDaemons - /Library/LaunchDaemons/*.plist. Runs as root at system boot regardless of login. Highest-value persistence - requires admin to write, but attackers who've socially engineered a sudo password (osascript fake prompt is the standard play) will drop here. SIP protects /System/Library/LaunchDaemons/ but not /Library/LaunchDaemons/.
• System-managed launchd jobs - /System/Library/LaunchDaemons/ and /System/Library/LaunchAgents/ are SIP-protected; a modification here means SIP is disabled or the attacker has an entitlement bypass - treat as near-impossible absent nation-state tooling.
• launchd triggers to understand - plists can specify RunAtLoad (fires immediately), KeepAlive (respawn if killed), StartInterval/StartCalendarInterval (cron-like), WatchPaths (fire on filesystem change, great for file-drop triggers), QueueDirectories, MachServices (XPC endpoint), and LaunchEvents. Multiple keys = redundant persistence.
• Modern enumeration - launchctl list shows loaded jobs for the current session; launchctl print system and launchctl print gui/<UID> are the modern (Big Sur+) replacements and expose per-domain state including recent exit codes.

Login / session hooks

• Login Items (modern, BTM-tracked) - the user-facing "open at login" list from System Settings → Login Items. Modern (Ventura+) items register through SMAppService/SMLoginItemSetEnabled and are reflected in BTM (BackgroundItems-v*.btm). Legacy Login Items were stored in com.apple.backgroundtaskmanagementagent / com.apple.loginitems.plist; aftermath, DumpBTM, and KnockKnock all surface them.
• Login/Logout hooks - sudo defaults write com.apple.loginwindow LoginHook /path/script and the matching LogoutHook. Deprecated since 10.11 but still functional through at least Sonoma; rarely used by legit software, so a hit is high-signal. Stored in /var/root/Library/Preferences/com.apple.loginwindow.plist.
• loginwindow AutoLaunchedApplicationDictionary - the old per-user "launch at login" plist (~/Library/Preferences/com.apple.loginwindow.plist, key AutoLaunchedApplicationDictionary). Largely superseded by BTM but attackers writing legacy-style persistence to appear low-risk still land here.

Configuration Profiles & MDM

• Configuration Profiles - /Library/Managed Preferences/, /var/db/ConfigurationProfiles/, enumerated via profiles list. Profiles can push LaunchAgents, add trusted root CAs, pin SSL, change DNS, install extensions, and gate TCC approvals, effectively a legitimate persistence + policy bypass channel. Scattered Spider / Octo Tempest abuses this by social-engineering MDM enrollment of attacker-controlled devices, and infostealer droppers add rogue root CAs via a user-level profile to man-in-the-middle browser traffic. Any profile not pushed by your known MDM is suspect.
• Rogue MDM enrollment - profiles under /var/db/ConfigurationProfiles/Store/ with unknown payload identifiers; check profiles -P for installed profiles and profiles status -type enrollment for enrollment state.

Scheduled execution

• cron - /etc/crontab, /var/at/tabs/<user>, /etc/cron.d/. Still works but Apple has quietly deprecated it (no cron is installed by default on new users). Any live crontab on a corp Mac is suspicious - launchd is the sanctioned path.
• at jobs - /var/at/jobs/; disabled by default but attackers sometimes re-enable with launchctl load /System/Library/LaunchDaemons/com.apple.atrun.plist.
• Periodic - /etc/periodic/daily/, weekly/, monthly/, driven by /System/Library/LaunchDaemons/com.apple.periodic-*.plist. The /etc/periodic tree is not SIP-protected and a drop here fires on a predictable cadence as root. Low-prevalence, high-signal.

Dynamic linker & library abuse

• DYLD_INSERT_LIBRARIES - macOS's analog of LD_PRELOAD; forces a dylib into a target process's address space. SIP strips all DYLD_* env vars from the environment of SIP-protected binaries and hardened-runtime binaries, so it only works against third-party apps without the hardened runtime or against processes started by the attacker. Set via a LaunchAgent plist's EnvironmentVariables dict or via an app's shell wrapper. Great for stealthy credential theft against browsers / password managers that opt out of hardening.
• Dylib hijacking / proxying - Patrick Wardle's classic attack: planting a malicious dylib at a path an app searches before the legit one (@rpath, @loader_path, @executable_path ambiguity), or exporting the legit symbols and forwarding to the real dylib so the app still works. Detect with DylibHijackScanner / Objective-See's DHS, or diff dylib load lists (otool -L) against a clean baseline. Still works against third-party apps lacking library validation.
• DYLD_FALLBACK_LIBRARY_PATH / DYLD_FRAMEWORK_PATH - alternative load-path env vars; same SIP caveats as above.

Authentication & authorization plugins

• AuthorizationPlugins - /Library/Security/SecurityAgentPlugins/*.bundle, invoked by Apple's Security Server during authorization right evaluation (login, unlock, admin prompts). A rogue plugin can observe or capture credentials on every authentication. Legitimate uses are rare (Jamf Connect, Okta Device Access, Kerberos SSO) - anything else needs explanation. Enforced loading rules live in /etc/authorization (deprecated) and the authorization database /var/db/auth.db.
• PAM on macOS - /etc/pam.d/. Same PAM concept as Linux; sshd, sudo, login, authorization all reference it. Rogue PAM modules under /usr/lib/pam/ intercept credentials. Rare on Macs but devastating when present.
• Keychain Access Control List (ACL) tampering - attackers who already have user password can modify Keychain ACLs so a malicious binary can read specific items without prompting on each access.

Legacy / niche - check on older or high-value systems

• emond - removed in Ventura (13). If a client is still on Monterey or older, look at /etc/emond.d/rules/*.plist and /private/var/db/emondClients/. Was a classic because the Apple-shipped com.apple.emond.plist LaunchDaemon ran rules under /etc/emond.d/rules/ as root with no file-signature check. Dead on modern macOS - do not cite without the version caveat.
• Scripting Additions - /Library/ScriptingAdditions/*.osax or ~/Library/ScriptingAdditions/. Legacy AppleScript extension mechanism; loaded by any process using AppleScript. Rare in modern tradecraft.
• Login window authorization database tampering - rights at system.login.console can be modified to require a rogue authorization right.
• launchd overrides - /var/db/com.apple.xpc.launchd/disabled.plist and disabled.<UID>.plist; attackers can re-enable Apple-disabled jobs or disable security daemons.
• Dock / Finder plist tampering - swap the binary a Dock icon or Finder service points at. Rare but has been seen in highly targeted ops.

Security subsystems

These are the macOS controls attackers must defeat, bypass, or live with - understanding what each one does and what it doesn't cover is critical for interpreting evidence. SIP protects system paths and strips dangerous env vars from protected binaries; disabling it requires a Recovery-mode reboot and is a bright-line "unauthorized access" indicator. Gatekeeper + notarization enforce that Internet-downloaded code is signed and Apple-reviewed, but a user who clicks "Open Anyway" or an attacker who downloads code outside the quarantine path (via curl, git, or a terminal command) bypasses the prompt entirely. TCC gates sensitive-data access per app; abuses typically involve either social-engineering the consent prompt or writing TCC.db directly while SIP is disabled.

• SIP (System Integrity Protection) - csrutil status. Disabled only via Recovery; disablement is a bright-line indicator.
• Gatekeeper - spctl --status; policy at /var/db/SystemPolicy, /var/db/SystemPolicyConfiguration.
• XProtect - Apple's AV; defs at /Library/Apple/System/Library/CoreServices/XProtect.bundle; XProtect Remediator (XProtectRemediator*) scans in background. Detections logged in Unified Log - subsystem == "com.apple.XProtectFramework.PluginAPI".
• MRT (Malware Removal Tool) - superseded by XProtect Remediator but still present on older OS.
• Notarization - code must be notarized to run w/o Gatekeeper prompt; CloudKit tickets stapled to app.
• FileVault - fdesetup status; Institutional Recovery Key for enterprise. For imaging you'll want the recovery key or user password.
• APFS encryption is per-volume; snapshots inherit.

Modern macOS threat picture (2024-26)

• Atomic Stealer (AMOS), Cuckoo Stealer, Poseidon, Banshee Stealer - macOS infostealers growing fast; targets Keychain, browser cookies, crypto wallets, Notes.
• DPRK clusters - RustBucket, KANDYKORN, SmoothOperator (3CX), ObjCShellz; often lure via LinkedIn/dev interviews, drop AppleScript / Mach-O.
• Delivery via malicious DMG + osascript to pop a fake sudo prompt and steal password → Keychain dump.
• Rosetta artifacts (/Library/Apple/usr/share/rosetta) for x86-translated payloads on Apple Silicon.

macOS triage tooling

• aftermath (Jamf - modern go-to; collects + parses in Swift)
• mac_apt (Yogesh Khatri - most comprehensive offline analysis framework; parses hundreds of artifacts)
• AutoMacTC (Palantir - dated but still handy for quick triage)
• macOS UAC (variant of the Unix-like Artifacts Collector)
• Velociraptor macOS artifacts (ES-based + plist parsers)
• Yelp OSXCollector (legacy; still works)
• Recon ITR (SUMURI, commercial, most polished UI)
• FTK Imager / MacQuisition / BlackBag MacQuisition for logical/physical acquisition
• Objective-See suite - KnockKnock (persistence), BlockBlock, LuLu (firewall), DumpBTM, WhatsYourSign, ReiKey - Patrick Wardle's defender toolkit
• APOLLO (Sarah Edwards) - pattern-of-life timeline across SQLite stores
• PlistBuddy (/usr/libexec/PlistBuddy), plutil, defaults, plistutil, plist-parse for plist analysis