Axefetchem Mac OS
Over the years, the FortiGuard Labs team has learned that it is very common for macOS malware to launch a new process to execute its malicious activity. So in order to more efficiently and automatically analyze the malicious behaviors of malware targeting macOS, it is necessary to develop a utility to monitor process execution. The MACF on macOS is a good choice to implement this utility. The Mandatory Access Control Framework - commonly referred to as MACF - is the substrate on top of which all of Apple’s securities, both macOS and iOS, are implemented. In this blog, I will detail the implementation of monitoring process execution, including command line arguments, via MACF.
Background
If you are interested in the research of malware and vulnerabilities on macOS, the blogs from objective-see.com are great study resource. The blog series “Monitoring Process Creation via the Kernel” explains how to monitor process creation via the kernel using MACF and KAuth (Kernel Authorization). However, it did not show how to implement monitor process execution with command line arguments. During the process of analyzing malware on macOS, the malware usually executes new processes to perform specific malicious activities in background. These new processes are frequently executed with command line arguments. So to analyze them, it’s fairly necessary to monitor process execution with all of the command line arguments.
The native port to OS X of the TASKING compiler breaks down the barriers for developing embedded applications for Mac users, while allowing them to work efficiently in their platform of choice. Cooperation with STMicroelectronics made it possible to offer in-circuit debug capabilities with the Eclipse integrated TASKING debugger, using the USB. The current distribution is MacTeX-2021 This distribution requires Mac OS 10.14, Mojave, or higher and runs natively on Intel and Arm processors.
Developing a Tool to Monitor Process Execution
First, you need to register your MAC Policy, as shown in Figure 1.
Axefetchem Mac Os Catalina
Apple ceased support for booting on PowerPC as of Mac OS X 10.6 'Snow Leopard' in August 2009, three years after the transition was complete. Support for PowerPC applications via Rosetta was dropped from macOS in 10.7 'Lion' in July 2011, five years after the transition was complete.