# [HIGH] Bad Apples: Weaponizing Native macOS Primitives for Movement and Execution **Source:** Cisco Talos **Published:** 2026-04-21 **Article:** https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ **Curated:** Analyst-reviewed 2026-04-28 ## Threat profile Talos's threat-spotlight on **macOS Living-off-the-Land (LOTL)** — the macOS equivalent of the Windows-LOLBin / lolbas-project body of work, but published research is **5+ years behind**. Talos catalogues abuses of native macOS primitives: - **Remote Application Scripting (RAS)** / `osascript` for remote command execution. - **`/usr/libexec/PlistBuddy`** for stealthy LaunchAgent / LaunchDaemon manipulation without `defaults` traces. - **`mdfind` / `mdimport`** for Spotlight-driven enumeration without triggering normal find-tools telemetry. - **`dscl`** for directory-services queries (user enumeration, group manipulation). - **`open -a` / `defaults write`** for app-launch and persistence. - **`security`** binary for keychain extraction. - **`scutil` / `networksetup`** for proxy / DNS reconfiguration. - **`sshd` / `screensharingd` / `apple_remote_desktop`** for native remote-access lateral movement (no third-party RMM needed). Why this is operationally important regardless of macOS share-of-fleet: - macOS is **5-15% of most enterprise endpoints** (engineering, exec, design teams) but the **detection coverage is 5-7 years behind Windows**. - LOTL means **no malware to scan for** — adversaries chain native binaries that are signed by Apple. - Talos's catalogue is **detection-engineering inspiration**: every primitive listed is a candidate hunt rule. We've kept severity **HIGH** as a strategic / detection-backlog item. The article doesn't disclose new IOCs (the `1.3.6.1` IOC the auto-extractor picked up is noise — that's a SNMP / ASN.1 OID prefix, not an IP). The value is the **TTP catalogue** that's now bookmarked Talos research. ## Indicators of Compromise - _Talos Bad Apples is a TTP-and-technique paper, not a campaign report — no actor-attributed IOCs._ - The auto-extracted IPv4 `1.3.6.1` is a false positive (it's the ISO/IANA OID root, not a network address). Flagging here so the SOC doesn't waste cycles on it. ## MITRE ATT&CK (analyst-validated) - **T1059.002** — AppleScript (osascript) - **T1059.004** — Unix Shell (zsh / bash on macOS) - **T1218** — System Binary Proxy Execution (LOLBin class) - **T1021.001** — Remote Services: RDP-equivalent (Apple Remote Desktop) - **T1021.004** — Remote Services: SSH - **T1083** — File and Directory Discovery (mdfind / find) - **T1087** — Account Discovery (dscl) - **T1543.001** — Create or Modify System Process: Launch Agent - **T1543.004** — Launch Daemon - **T1547.001** — Boot or Logon Autostart Execution: Login Item - **T1555.001** — Credentials from Password Stores: Keychain - **T1574.006** — Hijack Execution Flow: DYLD Hijacking - **T1564.011** — Hide Artifacts: Ignore Process Interrupts (`nohup`, `disown`) ## Recommended SOC actions (priority-ordered) 1. **Bookmark the Talos catalogue** as your macOS-LOTL detection-engineering backlog. 2. **Build the LOTL detections below.** Each one is **rare on legit macOS endpoints** and **high-fidelity** when fired: - `osascript -e 'do shell script ...'` - `PlistBuddy ... LaunchAgents` / `LaunchDaemons` - `security find-generic-password` from non-helpdesk-tooling parents - `dscl . -read /Users/...` from non-developer accounts - `screensharingd` / `apple_remote_desktop` services activated outside corp helpdesk 3. **Confirm macOS endpoint telemetry coverage.** If you don't have process-event telemetry from your Mac fleet (Defender for Endpoint on macOS, CrowdStrike, SentinelOne), build it first; LOTL detection is impossible without process events. 4. **Apply LaunchAgent / LaunchDaemon FIM** — every plist created in `~/Library/LaunchAgents/`, `/Library/LaunchAgents/`, `/Library/LaunchDaemons/` should generate an alert event. 5. **Review screen-sharing service status** across your Mac fleet — many users have Screen Sharing accidentally enabled; that's a remote-access surface for any adversary with valid creds. ## Splunk SPL — macOS osascript with shell / network content ```spl | tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="osascript" AND (Processes.process="*do shell script*" OR Processes.process="*do JavaScript*" OR Processes.process="*curl*" OR Processes.process="*wget*" OR Processes.process="*bash -i*" OR Processes.process="*/dev/tcp/*" OR Processes.process="*tell application*") by Processes.dest, Processes.user, Processes.process, Processes.parent_process_name | `drop_dm_object_name(Processes)` ``` ## Splunk SPL — PlistBuddy editing LaunchAgents / LaunchDaemons ```spl | tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process="*PlistBuddy*" AND (Processes.process="*LaunchAgents*" OR Processes.process="*LaunchDaemons*" OR Processes.process="*StartupItems*" OR Processes.process="*LoginItems*") by Processes.dest, Processes.user, Processes.process, Processes.parent_process_name | `drop_dm_object_name(Processes)` ``` ## Splunk SPL — security binary keychain queries ```spl | tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="security" AND (Processes.process="*dump-keychain*" OR Processes.process="*find-generic-password*" OR Processes.process="*find-internet-password*" OR Processes.process="*unlock-keychain*") by Processes.dest, Processes.user, Processes.process, Processes.parent_process_name | `drop_dm_object_name(Processes)` ``` ## Splunk SPL — dscl directory enumeration ```spl | tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="dscl" AND (Processes.process="*read /Users*" OR Processes.process="*list /Users*" OR Processes.process="*list /Groups*" OR Processes.process="*search*") by Processes.dest, Processes.user, Processes.process, Processes.parent_process_name | `drop_dm_object_name(Processes)` ``` ## Defender KQL — macOS osascript with shell content ```kql DeviceProcessEvents | where Timestamp > ago(60d) | where FileName == "osascript" | where ProcessCommandLine has_any ( "do shell script", "do JavaScript", "curl ", "wget ", "bash -i", "/dev/tcp/", "tell application") | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc ``` ## Defender KQL — PlistBuddy on persistence locations ```kql DeviceProcessEvents | where Timestamp > ago(60d) | where ProcessCommandLine has "PlistBuddy" | where ProcessCommandLine has_any ("LaunchAgents","LaunchDaemons","StartupItems","LoginItems") | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc ``` ## Defender KQL — keychain dump attempts ```kql DeviceProcessEvents | where Timestamp > ago(60d) | where FileName == "security" | where ProcessCommandLine has_any ( "dump-keychain","find-generic-password","find-internet-password","unlock-keychain") | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc ``` ## Defender KQL — dscl directory queries ```kql DeviceProcessEvents | where Timestamp > ago(60d) | where FileName == "dscl" | where ProcessCommandLine has_any ("read /Users","list /Users","list /Groups","search") | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc ``` ## Why this matters for your SOC **macOS LOTL is the single biggest detection-engineering gap** in most enterprise SOCs. The Talos paper is one of the few public catalogues of the techniques, and it's explicitly **not actor-attributed** — it's a how-to-defend reference. Treat it as a quarterly self-audit: - For each primitive Talos lists, do you have a detection live? - For each one you don't, is the gap because telemetry is missing or because no rule exists yet? - macOS LaunchAgent / LaunchDaemon plist FIM is the single highest-leverage detection — catches DPRK Sapphire Sleet, BlueNoroff, Lazarus, and most other macOS persistence in one rule. The detection budget is the work; this article is the prompt to spend it. Bad Apples: Weaponizing native macOS primitives for movement and execution By William Charles Gibson , Ryan Conry Tuesday, April 21, 2026 06:00 Threat Spotlight As macOS adoption grows among developers and DevOps, it has become a high value target; however, native "living-off-the-land" (LOTL) techniques for the platform remain significantly under-documented compared to Windows.  Adversaries can bypass security controls by repurposing native features like Remote Application Scripting (RAS) fo… ## Indicators of Compromise (high-fidelity only) - **IPv4 (defanged):** `1.3.6.1` ## MITRE ATT&CK Techniques - **T1021.002** — SMB/Windows Admin Shares - **T1569.002** — Service Execution - **T1219** — Remote Access Software - **T1071** — Application Layer Protocol ## Kill chain phases observed _(none detected from narrative keywords)_ ## Recommended hunts ### Remote service execution — PsExec / SMB lateral movement `UC_LATERAL_PSEXEC` · phase: **actions** · confidence: **High** **Splunk SPL (CIM):** ```spl | tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("psexec.exe","psexesvc.exe","paexec.exe","smbexec.py") OR (Processes.process_name="wmic.exe" AND Processes.process="*/node:*") by Processes.dest, Processes.user, Processes.process_name, Processes.process, Processes.parent_process_name | `drop_dm_object_name(Processes)` ``` **Defender KQL:** ```kql DeviceProcessEvents | where Timestamp > ago(7d) | where FileName in~ ("psexec.exe","psexesvc.exe","paexec.exe","smbexec.py") or (FileName =~ "wmic.exe" and ProcessCommandLine has "/node:") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine ``` ### RMM tool installed by non-IT user — remote-access utility for hands-on-keyboard `UC_RMM_TOOLS` · phase: **install** · confidence: **High** **Splunk SPL (CIM):** ```spl | tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("AnyDesk.exe","TeamViewer.exe","TeamViewer_Service.exe", "ScreenConnect.ClientService.exe","ConnectWiseControl.ClientService.exe", "atera_agent.exe","SplashtopStreamer.exe","RustDesk.exe","NinjaOne.exe","kaseya*.exe") by Processes.dest, Processes.user, Processes.process_name, Processes.process, Processes.parent_process_name | `drop_dm_object_name(Processes)` ``` **Defender KQL:** ```kql DeviceProcessEvents | where Timestamp > ago(7d) | where FileName in~ ("AnyDesk.exe","TeamViewer.exe","TeamViewer_Service.exe", "ScreenConnect.ClientService.exe","ConnectWiseControl.ClientService.exe", "atera_agent.exe","SplashtopStreamer.exe","RustDesk.exe","NinjaOne.exe") or FileName matches regex @"(?i)kaseya.*\.exe" | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine ``` ### IOC-driven hunts (use shared templates) These are standard IOC-substitution hunts — the canonical SPL and KQL live once in [`_TEMPLATES.md`](../_TEMPLATES.md), so we don't repeat the same boilerplate on every CVE / hash / network-IOC briefing. - **Network connections to article IPs / domains** ([template](../_TEMPLATES.md#network-ioc)) — phase: **c2**, confidence: **High** - IP / domain IOC(s): `1.3.6.1` ## Why this matters Severity classified as **HIGH** based on: IOCs present, 3 use case(s) fired, 4 technique(s) inferred. Read the full article for actor attribution, tooling details, and any defanged IOCs in the body that aren't visible in the RSS summary.