Macos Postexploit

macOS Post-Exploitation Methodology

46 programs across 8 categories for comprehensive macOS post-exploitation. Uses native tools (security, dtrace, xattr, log, launchctl, dscl, defaults, osascript), Python, and direct SQLite access.

Prerequisites

Before deploying machook tools, verify:

1. Root access — most operations require root (recon programs work without root)
2. SIP status — DTrace tools require SIP disabled (csrutil disable from Recovery Mode)
3. Native tools only — all tools use macOS CLI, no third-party dependencies

csrutil status                           # SIP status (DTrace needs disabled)
sw_vers                                  # macOS version
id                                       # current user/groups
security list-keychains                  # available keychains

Kill Chain Phases

Phase 1 — Reconnaissance (First 60 seconds)

Understand the target before deploying offensive tools.

CVE Integration: After running installed_apps or security_framework, check software versions against CVE database via cve-mcp (cve search_by_product --product <name> --version <ver>). If cve-mcp is not enabled: cyberstrike mcp enable cve.

Phase 2 — Credential Harvesting

Extract credentials from macOS-specific stores.

Phase 3 — Privilege Escalation

Escalate from user to root.

Phase 4 — Persistence

Maintain access across reboots.

Phase 5 — Monitoring

Observe target activity for intelligence gathering.

Phase 6 — Lateral Movement

Pivot to other systems on the network.

Phase 7 — Evasion & Anti-Forensics

Reduce forensic footprint and bypass defenses.

Phase 8 — Exfiltration & Cleanup (MANDATORY)

Stage data and remove all traces.

Detection Considerations

macOS post-exploitation tools are detectable by:

• Endpoint Security Framework (ESF) — EDR agents using es_new_client() for process/file/auth events
• Unified Logging — log show --predicate 'process == "security"' for Keychain access
• TCC audit — TCC access logged in Console.app, tccutil events visible
• SIP — When enabled, blocks DTrace system-wide tracing and TCC.db modification
• XProtect — Scans downloaded executables against YARA rules
• Gatekeeper — Checks code signing and quarantine attributes
• MDM/Jamf Protect — Managed Macs report configuration changes, new LaunchAgents
• CrowdStrike Falcon / SentinelOne — macOS EDR detects suspicious security command usage, CGEventTap, dylib injection
• LaunchDaemon monitoring — New plists in /Library/LaunchDaemons/ trigger alerts
• Authorization DB changes — Modifications to system.privilege.* rights are logged
• SSH audit — New authorized_keys entries, SSH tunnels visible in lsof

Program Reference