Inspect Macos Runtime Activity

Inspect macOS Runtime Activity

Overview

Build a time-correlated view of what ran, what changed, and what communicated. Prefer focused native observations and existing telemetry over installing a broad privileged monitor on an affected host.

Read references/macos-runtime-evidence.md for telemetry sources and permission boundaries.

Workflow

1. Fix host/build, user/session, time window, process/artifact identity, and reported symptom.
   • Label every observation as physical-host, affected-host, or macOS-guest evidence. For a guest, record VM tool/framework, virtual hardware, restore-image/build, shares/devices/network, baseline/reset state, and virtualization artifacts that may alter behavior.
2. Capture current process context.
   • Record PID, executable path/hash/signature, user, parent/ancestry, arguments, environment when authorized, start time, code state, and deleted/replaced executable clues.
3. Correlate files and registrations.
   • Record open files, working directory, mapped images, created/modified paths, quarantine/provenance, persistence registrations, and permission failures.
4. Correlate network behavior.
   • Record process-to-socket mapping, local/remote endpoints, DNS, protocol clues, timing, and whether a connection completed.
5. Inspect focused logs/events.
   • Query relevant unified logs and existing Endpoint Security/XProtect/Gatekeeper evidence for the narrow time window.
   • Record Full Disk Access, root, Endpoint Security entitlement, or other permissions required and what absence hides.
   • Treat missing collection permission or unavailable event types as a telemetry gap, not evidence that the behavior did not occur. Route app-facing permission implementation to macos-privacy-permissions-workflow and exact private-control interpretation to research-macos-security-control.
6. Build a timeline.
   • Separate user action, launch, child processes, file changes, prompts, network, persistence, detection, and termination.
7. Assess behavior and gaps.
   • Route binary internals, dynamic reproduction, containment, or hunting as needed.
   • State anti-VM, hardware, Secure Enclave, recoveryOS, kernel/system-extension, and device-access limitations before treating guest evidence as physical-Mac proof.

Output

Return process identity/ancestry, file/network/log timeline, permissions and coverage, observed versus inferred behavior, confidence, and next action.