Detect macOS security intrusions and misconfigurations using Velociraptor in local mode.
npx skills add https://github.com/chenchunrun/onyx-soc --skill macos-ir
Please help me install this Agent Skill. Skill: macos-ir Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/macos-ir Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill macos-ir
macOS 入侵检查与应急响应工作流，提供统一、可重复的检测与取证入口，帮助安全团队快速识别入侵迹象并制定处置计划。
运行统一入口脚本以执行快速的 macOS 入侵检查。
High-intent search queries and answers about installing and using this skill.
To check macOS for security intrusions, this Skill uses Velociraptor in local mode to hunt suspicious processes, persistence mechanisms, and unusual network activity. It applies a defined ATT&CK mapping for macOS to enable structured detections and generate a response plan.
Velociraptor detects persistence mechanisms on macOS by querying local system data such as LaunchAgents and LaunchDaemons using VQL. This approach identifies unauthorized background services and startup items that attackers use to maintain access.
Yes, you can use Velociraptor for incident response in enterprise macOS environments. It runs in local mode to perform rapid security assessments, scanning processes, network activity, and TCC configurations to produce an actionable remediation checklist.
The best way to automate macOS threat hunting with VQL is through a unified entry script that targets multiple detection modules. This method systematically identifies intrusion indicators across process trees and network connections.
Yes, you need access to macOS TCC data for comprehensive incident response checks. Analyzing TCC permissions helps identify misconfigurations and unauthorized application access to sensitive system resources.
Using a defined ATT&CK mapping for macOS intrusion detection structures the threat hunting process by aligning suspicious process and network behaviors with known adversary tactics and techniques.
chenchunrunIdentify Linux security incidents by querying host telemetry with Velociraptor VQL.
zenobi-usCoordinate incident response for security breaches and operational incidents.
4lermanScore hunting hypotheses against MITRE ATT&CK techniques and IOC data.
AgentSecOpsAnalyze endpoint telemetry and artifacts for incident response with Velociraptor VQL workflows.
