From Zero to a Skilled macOS Incident Responder

A complete walkthrough of how macOS threats are delivered, persist, execute, and evade controls. Participants move from basic system concepts (quarantine attributes, bundles, plists) to practical reverse-engineering workflows (DMGs, PKGs, Mach-O binaries, scripts, shared libraries).

The course emphasizes hands-on inspection using built-in tools and analyst-friendly utilities, supported by examples of current stealer families and real-world infection chains such as malvertising and fake apps. Persistence triage, code-signature validation, dynamic analysis, and artifact collection form the core investigative skill set. Advanced sections cover anti-analysis, TCC bypasses, XProtect internals, unified logs, and modern attacker tooling.

By the end, attendees can confidently analyze macOS malware samples, determine malicious intent, and map out actionable detection points.

Syllabus

• Opening & Context
• macOS Malware Protections: Evolution & Current State
• 2025 Threat Landscape
• Building the macOS Analysis Lab
• Infection Vectors
• macOS Threat File Types & Delivery Mechanisms
• Disk Images & Application Bundles
• Plists & Configuration Artifacts
• PKG Internals & Installation Scripts
• Script Analysis
• Persistence Mechanisms
• Determining Maliciousness
• Binaries, Libraries & Static Analysis
• Python-Packaged Malware
• Dynamic Analysis
• Post-Incident Collection
• Extended Attributes & Quarantine Flags

Audience

Incident responders and SOC Analysts who want to learn the basics of macOS forensics, especially designed for quick triages and analysis.

Enquiries

Contact us to schedule a private delivery or request tailoring.