macOS Forensic Triage & Live Response

APPLE SILICON & INTEL MDE LIVE RESPONSE & ZSH Scope: macOS 13+ (Ventura, Sonoma, Sequoia)

In modern enterprise environments, macOS endpoints frequently handle sensitive source code, cloud administrative sessions, and executive credentials. Managed via Microsoft Intune and monitored by Microsoft Defender for Endpoint (MDE), macOS artifacts differ fundamentally from Windows NTFS.

🧭 Master Artifact Location Matrix

Category	On-Disk Location	Forensic Purpose
Unified Logs (Tracev3)	`/var/db/diagnostics/` and `/var/db/uuidtext/`	System-wide event telemetry, auth, sudo, process launch
TCC Permissions	`/Library/Application Support/com.apple.TCC/TCC.db`	System-level camera, mic, accessibility, full-disk access
User TCC Permissions	`~/Library/Application Support/com.apple.TCC/TCC.db`	Per-user privacy permissions and access overrides
System LaunchDaemons	`/Library/LaunchDaemons/` (Root privilege)	Root persistence executing at boot without user login
User LaunchAgents	`~/Library/LaunchAgents/` & `/Library/LaunchAgents/`	User persistence executing upon GUI user login
Login Items (BTM)	`/private/var/db/com.apple.backgroundtaskmanagement/`	Background Task Management database for persistence
Intune Script Logs	`/Library/Application Support/Microsoft/IntuneScripts/`	Logs, output, and execution history for Intune shell scripts
Shell Histories	`~/.zsh_history`, `~/.bash_history`	Interactive commands executed by operators or attackers
Quarantine Database	`~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV7`	Safari, Chrome, and AirDrop downloaded file provenance
FSEvents	`/.fseventsd/` (Requires raw parser)	File system creation, deletion, and rename historical logs

📜 1. Apple Unified Logging (AUL) Forensics

Unified Logs are stored in a proprietary binary compressed format (.tracev3). Querying them requires the native /usr/bin/log command.

Extracting Sudo & Authentication Events

🎯 What it looks for: Elevated privileges granted via sudo, graphical user logons via loginwindow, and directory service queries (opendirectoryd) across the last 24 hours.
💡 Why it matters: Captures successful and failed root escalation attempts, interactive user console logons, and account switching. When an attacker runs terminal commands as root or pivots through local admin credentials, the invocation is preserved here.

# Query authentication events from the last 24 hours
log show --style syslog --predicate 'process == "sudo" || process == "loginwindow" || process == "opendirectoryd"' --info --backtrace --last 24h

Hunting Hidden Process Invocations & Execution

🎯 What it looks for: Low-level kernel events recording process spawn primitives (execve, posix_spawn) within the past 2 hours.
💡 Why it matters: Attackers often invoke scripts or binaries without an interactive terminal window (e.g. background reverse shells, staged droppers, or cron jobs). Filtering Unified Logs for kernel spawn calls captures the exact binary path and parameters even if shell command history is wiped.

# Filter process launches via execve/posix_spawn
log show --predicate 'eventMessage CONTAINS "spawn" || eventMessage CONTAINS "execve"' --info --last 2h

Exporting Full Log Archive for Offline Analysis

🎯 What it looks for: Bundles volatile unified log files, diagnosis databases, and string catalogs from /var/db/diagnostics/ into an offline .logarchive forensic container.
💡 Why it matters: Unified logs roll over rapidly based on system activity. Collecting the logarchive immediately via Live Response preserves the critical timeline before events are overwritten, allowing deep inspection on an analyst Mac using Console.app.

# Collect system logarchive (run as root via MDE Live Response)
sudo log collect --output /tmp/mac_evidence.logarchive --last 4h

🎯 What it looks for: SQL query against the system-level privacy database (TCC.db) listing all applications granted explicit permissions (auth_value = 2) such as Full Disk Access, Screen Capture, Accessibility, or Microphone access.
💡 Why it matters: Modern macOS enforces strict sandboxing. Infostealers and RATs cannot read Safari/Chrome session cookies, access user keychains, or capture keystrokes unless granted TCC permissions. Attackers attempt to trick users into granting permissions or exploit MDM profiles to bypass TCC silently.

# Query the system TCC database using sqlite3
sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
  "SELECT client, service, auth_value, auth_reason, strftime('%Y-%m-%d %H:%M:%S', last_modified, 'unixepoch') FROM access WHERE auth_value = 2;"

Suspicious Services to Scrutinize

kTCCServiceSystemPolicyAllFiles (Full Disk Access)
kTCCServiceAccessibility (Keylogging, UI manipulation)
kTCCServiceScreenCapture (Screen recording / espionage)
kTCCServiceMicrophone / kTCCServiceCamera

🔄 3. macOS Persistence Mechanisms

Audit System LaunchDaemons (Root Persistence)

🎯 What it looks for: Property list (.plist) files registered under /Library/LaunchDaemons/ with recent modification timestamps, non-root ownership, or executable binaries located outside standard system directories (/Applications, /Library).
💡 Why it matters: LaunchDaemons execute with root privileges at system boot without requiring an interactive user logon. This is the gold-standard persistence vector for advanced macOS threats, backdoor agents, and rogue management tools.

# List all LaunchDaemons with non-standard ownership or recent modifications
ls -lTa /Library/LaunchDaemons/ /System/Library/LaunchDaemons/

# Inspect suspicious plist program argument
sudo plutil -p /Library/LaunchDaemons/com.suspicious.service.plist

Inspecting Background Task Management (Ventura+)

🎯 What it looks for: Dumps the macOS Background Task Management (BTM) database, listing all registered login items, background launch services, and persistent daemons known to the OS.
💡 Why it matters: Starting in macOS 13 (Ventura), Apple introduced system notifications when background items are registered. Adversaries may attempt to suppress these notifications via MDM profiles or manipulate the BTM database directly to hide their persistence.

# Dump registered background tasks via sfltool
sfltool dumpbtm

☁️ 4. Intune for macOS Execution Forensics

🎯 What it looks for: Inspects the Microsoft Intune Management Agent directory (/Library/Application Support/Microsoft/IntuneScripts/) for deployed shell scripts, run logs, and exit status.
💡 Why it matters: If an attacker compromises an Intune Administrator or Global Admin account in Entra ID, they can push arbitrary bash/zsh scripts to all managed Macs with root authority. Examining this directory reveals whether unauthorized administrative scripts were deployed from the cloud.

# Check executed scripts deployed by Intune
ls -la "/Library/Application Support/Microsoft/IntuneScripts/"

# View run logs and exit codes
cat "/Library/Logs/Microsoft/Intune/IntuneMDMDaemon.log" | grep -i "script"

⚡ 5. MDE Live Response Quick Triage (macOS)

🎯 What it looks for: High-density triage commands run within a Defender for Endpoint Live Response shell: top CPU/memory processes, active internet-bound sockets, listening ports, code-signing validity, and SIP enforcement status.
💡 Why it matters: Provides instant situational awareness during an active containment call. Unsigned binaries listening on non-standard ports or disabled System Integrity Protection (SIP) provide immediate confirmation of a host breach.

# 1. Process tree and network connections
ps aux | sort -rn -k 3,3 | head -n 25
netstat -anv -f inet

# 2. Check open listening sockets and associated binaries
lsof -iTCP -sTCP:LISTEN -P -n

# 3. Check unsigned or ad-hoc signed executing binaries
codesign -dv --verbose=4 /path/to/suspect_binary 2>&1 | grep -E "Authority|Signature"

# 4. Check SIP (System Integrity Protection) status
csrutil status