Bad Apples: Weaponizing native macOS primitives for movement and execution

The provided content outlines several techniques for lateral movement and persistence on macOS systems using native tools and protocols. Here's a summary of the key points:

Lateral Movement Techniques

1. Remote Apple Events (T1571)

   • AppleScript Execution: Use osascript to execute scripts remotely via Apple Events.
   • File Transfer with Remote Apple Events: Utilize AppleScript for transferring files between machines.

2. Remote Management Protocols (T1021)

   • VNC and Screen Sharing: Gain control over a remote machine using VNC or built-in Screen Sharing features.
   • Apple Remote Desktop (ARD): Use ARD to manage multiple macOS systems remotely, including file transfers and command execution.

3. Remote Services (T1021)

   • SSH: Establish an SSH connection for remote command execution and file transfer using SCP or SFTP.
   • Apple Events via AppleScript: Execute scripts on a remote machine by sending Apple Events through osascript.

4. Remote Desktop Protocol (RDP): Use RDP to gain access to macOS systems, though this is less common due to the native alternatives available.

Persistence

Read the full article at Cisco Talos

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.