macos-ir

To check macOS for security intrusions, this Skill uses Velociraptor in local mode to hunt suspicious processes, persistence mechanisms, and unusual network activity. It applies a defined ATT&CK mapping for macOS to enable structured detections and generate a response plan.

Velociraptor detects persistence mechanisms on macOS by querying local system data such as LaunchAgents and LaunchDaemons using VQL. This approach identifies unauthorized background services and startup items that attackers use to maintain access.

Yes, you can use Velociraptor for incident response in enterprise macOS environments. It runs in local mode to perform rapid security assessments, scanning processes, network activity, and TCC configurations to produce an actionable remediation checklist.

The best way to automate macOS threat hunting with VQL is through a unified entry script that targets multiple detection modules. This method systematically identifies intrusion indicators across process trees and network connections.

Yes, you need access to macOS TCC data for comprehensive incident response checks. Analyzing TCC permissions helps identify misconfigurations and unauthorized application access to sensitive system resources.

Using a defined ATT&CK mapping for macOS intrusion detection structures the threat hunting process by aligning suspicious process and network behaviors with known adversary tactics and techniques.