AEMonitor: Monitoring Apple Events for Malware Analysis and Detection
Using macOS Unified Logs to monitor Apple event debug output for malware analysis and detection, with AEMonitor.
pepe berba
stats, security, and crypto
Latest posts
Decompiling run-only AppleScripts
Developing a tool to allow direct decompilation of run-only Applescripts
Script Confusion: Playing with AppleScripts hidden in Named Forks
Exploring how we can use a legacy feature of AppleScript to hide payloads in other AppleScripts, images, and files.
MacOS Infection Vector: Using AppleScripts to bypass Gatekeeper
A look at how threat actors are abusing AppleScript .scpt files to deliver macOS malware, from fake documents to browser update lures, and how these scripts can still run despite Gatekeeper protections.
Acquiring Malicious Browser Extension Samples on a Shoestring Budget
Cracking the simple encryption scheme used by Genesis Market to hunt for malicious browser extensions
Hunting for Persistence in Linux (Part 5): Systemd Generators
How attackers can insert backdoors early in the boot process using systemd generators
Hunting for Persistence in Linux (Part 4): Initialization Scripts and Shell Configuration
How attackers create can maintain persistence by inserting scripts and executables in special locations that will run on boot or logon
Hunting for Persistence in Linux (Part 3): Systemd, Timers, and Cron
How attackers use newly created and existing accounts for peristence and how to detect them.
Hunting for Persistence in Linux (Part 2): Account Creation and Manipulation
How attackers use newly created and existing accounts for peristence and how to detect them.
Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)
An introduction to monitoring and logging in linux to look for persistence. With examples how to setup and detect web shell backdoors.