macOS系统入侵取证深度分析

log show --predicate 'process == "syslogd"' --last 1h
plutil -p /Library/LaunchDaemons/com.apple.plist
spctl --assess --verbose /Applications/Suspicious.app
codesign -dv --verbose=4 /Applications/App.app
xattr -l /path/to/file

dd if=/dev/disk0 of=/path/to/image.dd bs=4m
hdiutil create -format UDZO -source /dev/disk0 -target /path/to/image.dmg

tmutil listlocalsnapshots /
mount_apfs -s com.apple.TimeMachine.2024-01-01-000000 /dev/disk1s1 /mnt/snapshot

log show --predicate 'process == "syslogd"' --last 24h
log show --predicate 'eventMessage contains "login"' --style syslog
log show --predicate 'processImagePath contains "sudo"' --last 1h
log show --predicate 'senderImagePath contains "Gatekeeper"' --last 7d
log show --predicate 'subsystem == "com.apple.launchservices"' --last 2h

log show --predicate 'eventMessage contains "signpost"' --style ndjson
log show --predicate 'subsystem == "com.apple.signpost"' --last 1h

log show --predicate 'process == "loginwindow" OR process == "sudo" OR process == "sshd"' --last 24h --style syslog > login_timeline.log

ls -l /var/log/asl/

log show --predicate 'process == "WindowServer"' --last 1h | grep -i "capture"

cat /var/log/install.log | grep -E "Installed|Removed"

log show --last 24h | awk '{print $1, $2}' | sort | uniq -c

ls -l /var/db/diagnostics/
stat /var/log/system.log

#!/bin/bash

echo "=== macOS 日志异常检测 ==="

echo "[*] 检查最近 24 小时的登录事件"
log show --predicate 'process == "loginwindow" OR process == "sudo"' --last 24h --style syslog | grep -E "login|logout|sudo"

echo "[*] 检查 Gatekeeper 相关事件"
log show --predicate 'senderImagePath contains "Gatekeeper"' --last 7d | grep -E "bypass|override|disable"

echo "[*] 检查 SIP 相关事件"
log show --predicate 'eventMessage contains "SIP"' --last 7d

echo "[*] 检查 XProtect 事件"
log show --predicate 'process == "syslogd" AND eventMessage contains "XProtect"' --last 7d

echo "[*] 检查异常日志缺失"
log show --last 24h --style ndjson | jq -r '.time' | cut -d'T' -f1 | sort | uniq -c | awk '$1 < 10 {print "警告: " $2 " 日志数量异常少"}'

echo "[*] 检查安装事件"
grep -E "Installed|Removed" /var/log/install.log | tail -20

echo "[*] 检查 SSH 登录"
log show --predicate 'process == "sshd"' --last 24h | grep -E "Accepted|Failed"

plutil -p /Library/LaunchDaemons/com.suspicious.plist

for plist in /Library/LaunchAgents/*.plist ~/Library/LaunchAgents/*.plist; do
  echo "=== $plist ==="
  plutil -p "$plist" | grep -E "ProgramArguments|RunAtLoad|KeepAlive"
done

osascript -e 'tell application "System Events" to get the name of every login item'

crontab -l
ls -l /var/spool/cron/crontabs/
cat /etc/crontab

ls -l /etc/periodic/
cat /etc/periodic/daily/*

defaults read com.apple.loginwindow LoginHook
defaults read com.apple.loginwindow LogoutHook

ls -l /etc/pam.d/
cat /etc/pam.d/sshd
cat /etc/pam.d/sudo

grep -r "sharedlib" /etc/pam.d/

kextstat | grep -v com.apple

systemextensionsctl list

cat ~/.bash_profile
cat ~/.zshrc
cat ~/.profile
grep -r "export" ~/.*rc ~/.*profile 2>/dev/null

#!/bin/bash

echo "=== macOS 持久化全面扫描 ==="

echo "[*] LaunchAgents/LaunchDaemons 扫描"
for dir in /Library/LaunchAgents ~/Library/LaunchAgents /Library/LaunchDaemons; do
  if [ -d "$dir" ]; then
    echo "目录: $dir"
    for plist in "$dir"/*.plist; do
      if [ -f "$plist" ]; then
        prog=$(plutil -p "$plist" | grep ProgramArguments | head -1)
        if [ ! -z "$prog" ]; then
          echo "  $(basename $plist): $prog"
        fi
      fi
    done
  fi
done

echo "[*] Login Items 检查"
osascript -e 'tell application "System Events" to get the name of every login item' 2>/dev/null

echo "[*] cron 任务检查"
crontab -l 2>/dev/null

echo "[*] 登录钩子检查"
defaults read com.apple.loginwindow LoginHook 2>/dev/null
defaults read com.apple.loginwindow LogoutHook 2>/dev/null

echo "[*] 内核扩展检查"
kextstat | grep -v com.apple | awk '{print $6}'

echo "[*] 系统扩展检查"
systemextensionsctl list 2>/dev/null

echo "[*] 环境变量检查"
for file in ~/.bash_profile ~/.zshrc ~/.profile; do
  if [ -f "$file" ]; then
    echo "文件: $file"
    grep "export" "$file" | grep -v "^#"
  fi
done

echo "[*] PAM 模块检查"
grep -r "optional\|required" /etc/pam.d/ | grep -v "com.apple"

echo "[*] 异常 plist 检测（非 Apple 签名）"
for plist in /Library/LaunchAgents/*.plist /Library/LaunchDaemons/*.plist; do
  if [ -f "$plist" ]; then
    if ! codesign -v "$plist" 2>/dev/null; then
      echo "未签名: $plist"
    fi
  fi
done

xattr -d com.apple.quarantine /Applications/Suspicious.app
xattr -cr /Applications/Suspicious.app

xattr -l /Applications/Suspicious.app

spctl --assess --verbose /Applications/App.app

spctl --master-disable

spctl --status

codesign -dv --verbose=4 /Applications/App.app
codesign --verify --deep --strict /Applications/App.app

codesign -dv /Applications/App.app 2>&1 | grep TeamIdentifier

codesign -d --extract-cert /Applications/App.app
openssl x509 -in cert.pem -noout -dates

#!/bin/bash

echo "=== Gatekeeper 与签名异常检测 ==="

echo "[*] Gatekeeper 状态"
spctl --status

echo "[*] 检查隔离属性"
find /Applications -maxdepth 2 -name "*.app" -exec sh -c 'xattr -l "$1" 2>/dev/null | grep -q "com.apple.quarantine" || echo "无隔离属性: $1"' _ {} \;

echo "[*] 检查应用签名"
for app in /Applications/*.app; do
  if [ -d "$app" ]; then
    if ! codesign -v "$app" 2>/dev/null; then
      echo "签名无效: $app"
    else
      team=$(codesign -dv "$app" 2>&1 | grep TeamIdentifier | cut -d= -f2)
      if [ "$team" = "not set" ]; then
        echo "Ad-hoc 签名: $app"
      fi
    fi
  fi
done

echo "[*] 检查最近修改的应用"
find /Applications -maxdepth 2 -name "*.app" -mtime -7 -exec ls -ld {} \;

echo "[*] 检查公证状态"
for app in /Applications/*.app; do
  if [ -d "$app" ]; then
    result=$(spctl --assess --verbose "$app" 2>&1)
    if echo "$result" | grep -q "rejected"; then
      echo "公证失败: $app"
    fi
  fi
done

csrutil status

csrutil status
csrutil authenticated-root status

nvram -p | grep -i sip
nvram -p | grep csr

nvram -p | grep "recovery"

log show --predicate 'eventMessage contains "Recovery"' --last 7d

log show --predicate 'eventMessage contains "SIP" OR eventMessage contains "csrutil"' --last 7d

log show --predicate 'process == "amfid"' --last 1h

#!/bin/bash

echo "=== SIP 完整性验证 ==="

echo "[*] SIP 状态"
csrutil status

echo "[*] SIP 配置详情"
csrutil status | grep -E "System Integrity|Kext|Debug|FS|NVram"

echo "[*] NVRAM SIP 变量"
nvram -p | grep -i "csr\|sip"

echo "[*] 检查系统文件完整性"
diskutil apfs listSnapshots /

echo "[*] 检查内核扩展"
kextstat | grep -v com.apple | awk '{print $6, $7}'

echo "[*] 检查 AMFI 日志"
log show --predicate 'process == "amfid"' --last 1h | grep -E "deny|reject|invalid"

echo "[*] 检查 Recovery OS 启动记录"
log show --predicate 'eventMessage contains "Recovery"' --last 7d | head -10

echo "[*] 检查系统目录修改"
find /System -mtime -1 -type f 2>/dev/null | head -20

ls -l /Library/Apple/System/Library/CoreServices/XProtect.bundle/
ls -l /Library/Apple/System/Library/CoreServices/XProtectRemediator*

log show --predicate 'process == "syslogd" AND eventMessage contains "XProtect"' --last 7d

softwareupdate --history | grep XProtect

find / -name "agent.*" -path "*/Library/Application Support/*" 2>/dev/null

find / -name "*.js" -path "*/Library/LaunchAgents/*" 2>/dev/null

rule macOS_SilverSparrow {
    meta:
        description = "Silver Sparrow macOS 后门"
        author = "Security Team"
    strings:
        $s1 = "Library/Application Support/agent"
        $s2 = "updates.sh"
        $s3 = "version.txt"
    condition:
        all of them
}

rule macOS_XLoader {
    meta:
        description = "XLoader macOS 银行木马"
        author = "Security Team"
    strings:
        $s1 = "Library/LaunchAgents/com.apple.*.plist"
        $s2 = "keychain"
        $s3 = "safari"
    condition:
        all of them
}

security dump-keychain ~/Library/Keychains/login.keychain-db
security find-generic-password -s "ServiceName" ~/Library/Keychains/login.keychain-db
security find-internet-password -s "example.com" ~/Library/Keychains/login.keychain-db

security find-generic-password -ga "WiFi-Name" /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist

log show --predicate 'process == "securityd" OR eventMessage contains "keychain"' --last 1h

security show-keychain-info ~/Library/Keychains/login.keychain-db

log show --predicate 'eventMessage contains "keychain" AND (eventMessage contains "unlock" OR eventMessage contains "access")' --last 24h

#!/bin/bash

echo "=== Keychain 异常访问检测 ==="

echo "[*] Keychain 文件列表"
ls -l ~/Library/Keychains/

echo "[*] Keychain 锁定状态"
security show-keychain-info ~/Library/Keychains/login.keychain-db 2>/dev/null

echo "[*] 检查 Keychain 访问日志"
log show --predicate 'process == "securityd"' --last 1h | grep -E "access|unlock|error"

echo "[*] 检查 Wi-Fi 密码提取"
log show --predicate 'eventMessage contains "AirPort" AND eventMessage contains "password"' --last 24h

echo "[*] 检查 Safari 自动填充数据"
ls -l ~/Library/Safari/
defaults read ~/Library/Safari/SecureBookmarks.plist 2>/dev/null | head -20

echo "[*] 检查 Keychain 修改时间"
stat ~/Library/Keychains/login.keychain-db

tmutil listlocalsnapshots /
mount_apfs -s com.apple.TimeMachine.2024-01-01 /dev/disk1s1 /mnt/snapshot

cp -c original.txt clone.txt

diskutil apfs list

xattr -l /path/to/file

xattr -p com.apple.ResourceFork /path/to/file | xxd

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "SELECT * FROM access;"

#!/bin/bash

echo "=== APFS 取证数据提取 ==="

echo "[*] APFS 容器信息"
diskutil apfs list

echo "[*] APFS 快照列表"
tmutil listlocalsnapshots /

echo "[*] 扩展属性检查"
for file in /Applications/*.app; do
  attrs=$(xattr -l "$file" 2>/dev/null)
  if [ ! -z "$attrs" ]; then
    echo "文件: $file"
    echo "$attrs"
  fi
done

echo "[*] 隔离属性检查"
find /Applications -maxdepth 2 -exec xattr -l {} \; 2>/dev/null | grep -A2 "com.apple.quarantine"

echo "[*] TCC 数据库分析"
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "SELECT service, client, allowed FROM access WHERE allowed = 1;"

echo "[*] 文件时间戳分析"
stat -f "%N: Created=%SB Modified=%Sm" /Applications/*.app 2>/dev/null | head -20

echo "[*] 已删除文件恢复检查"
ls -l /.Spotlight-V100/ 2>/dev/null

ls -l /Library/Managed\ Preferences/
ls -l /var/db/ConfigurationProfiles/

profiles list -verbose
profiles show -all

system_profiler SPConfigurationProfileDataType

profiles list | grep -E "URL|ServerURL"

log show --predicate 'process == "mdmclient"' --last 24h

ls -l /Library/Application\ Support/Jamf/
cat /Library/Application\ Support/Jamf/Logs/Jamf.log

ls -l /Library/Application\ Support/Kandji/

#!/bin/bash

echo "=== MDM 配置审计 ==="

echo "[*] MDM 配置文件列表"
profiles list -verbose

echo "[*] 设备注册类型"
system_profiler SPConfigurationProfileDataType | grep -E "Type|URL"

echo "[*] MDM 服务器信息"
profiles list | grep -E "ServerURL|CheckInURL"

echo "[*] MDM 命令历史"
log show --predicate 'process == "mdmclient"' --last 24h | grep -E "Install|Remove|Configure"

echo "[*] 检查托管偏好"
ls -l /Library/Managed\ Preferences/

echo "[*] 检查配置描述文件"
ls -l /var/db/ConfigurationProfiles/Settings/

echo "[*] 检查 MDM 守护进程"
launchctl list | grep mdm

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
/usr/libexec/ApplicationFirewall/socketfilterfw --listapps

log show --predicate 'process == "socketfilterfw"' --last 1h

system_profiler SPConfigurationProfileDataType | grep -i "remote"
defaults read /Library/Preferences/com.apple.RemoteManagement

systemsetup -getremotelogin
log show --predicate 'process == "sshd"' --last 24h | grep -E "Accepted|Failed"

scutil --nc list
networksetup -listallnetworkservices

log show --predicate 'process == "nesessionmanager"' --last 24h

networksetup -getautoproxyurl Wi-Fi

networksetup -getwebproxy Wi-Fi
networksetup -getsecurewebproxy Wi-Fi
networksetup -getsocksfirewallproxy Wi-Fi

nettop -P -k state,interface,rx_delt,rx_rate,tx_delt,tx_rate

netstat -anv | grep ESTABLISHED

tcpdump -i en0 -w capture.pcap

#!/bin/bash

echo "=== 网络异常检测 ==="

echo "[*] 防火墙状态"
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

echo "[*] 防火墙应用列表"
/usr/libexec/ApplicationFirewall/socketfilterfw --listapps | grep -E "Allow|Deny"

echo "[*] 远程管理状态"
systemsetup -getremotelogin

echo "[*] SSH 登录历史"
log show --predicate 'process == "sshd"' --last 24h | grep -E "Accepted|Failed" | tail -20

echo "[*] VPN 连接状态"
scutil --nc list

echo "[*] 代理配置"
networksetup -getautoproxyurl Wi-Fi
networksetup -getwebproxy Wi-Fi

echo "[*] 活跃网络连接"
netstat -anv | grep ESTABLISHED | awk '{print $1, $5, $9}'

echo "[*] 异常端口监听"
lsof -i -P | grep LISTEN | grep -v "com.apple"

echo "[*] DNS 查询缓存"
dscacheutil -cachedump -entries 2>/dev/null | head -20

/Library/LaunchDaemons/com.suspicious.plist
~/Library/LaunchAgents/com.malware.plist
/Library/Application Support/malware/
/tmp/.hidden_payload

185.x.x.x:443 (C2)
malicious-domain.com
updates.suspicious-service.com

csrutil disable
xattr -d com.apple.quarantine
codesign --force --sign - /path/to/binary

初始访问 → 执行 → 持久化 → 权限提升 → 凭据访问 → 发现 → 横向移动 → 数据外传

log show --last 24h --style ndjson | jq -c '{time: .time, process: .process, message: .eventMessage}' > timeline.json

plutil -p /Library/LaunchDaemons/com.suspicious.plist | grep -E "ProgramArguments|RunAtLoad"

title: macOS SIP 禁用检测
id: 1a2b3c4d-5e6f-7g8h-9i0j
status: experimental
description: 检测 SIP 被禁用的情况
author: Security Team
date: 2024/01/01
logsource:
  product: macos
  category: system
detection:
  selection:
    EventID: 1
    CommandLine|contains: 'csrutil disable'
  condition: selection
level: high
tags:
  - attack.defense_evasion
  - attack.t1553.001

title: macOS Gatekeeper 绕过检测
id: 2b3c4d5e-6f7g-8h9i-0j1k
status: experimental
description: 检测隔离属性被移除
author: Security Team
date: 2024/01/01
logsource:
  product: macos
  category: system
detection:
  selection:
    CommandLine|contains: 'xattr -d com.apple.quarantine'
  condition: selection
level: medium
tags:
  - attack.defense_evasion
  - attack.t1553.001

#!/bin/bash

echo "=== macOS 安全狩猎脚本 ==="

echo "[*] 1. 检查异常 LaunchAgent/LaunchDaemon"
for plist in /Library/LaunchAgents/*.plist ~/Library/LaunchAgents/*.plist /Library/LaunchDaemons/*.plist; do
  if [ -f "$plist" ]; then
    if ! codesign -v "$plist" 2>/dev/null; then
      echo "[!] 未签名 plist: $plist"
      plutil -p "$plist" | grep ProgramArguments
    fi
  fi
done

echo "[*] 2. 检查 SIP 状态"
if csrutil status | grep -q "disabled"; then
  echo "[!] SIP 已禁用"
fi

echo "[*] 3. 检查 Gatekeeper 状态"
if spctl --status | grep -q "disabled"; then
  echo "[!] Gatekeeper 已禁用"
fi

echo "[*] 4. 检查内核扩展"
kexts=$(kextstat | grep -v com.apple | wc -l)
if [ "$kexts" -gt 0 ]; then
  echo "[!] 发现非 Apple 内核扩展:"
  kextstat | grep -v com.apple
fi

echo "[*] 5. 检查异常端口"
lsof -i -P | grep LISTEN | grep -v "com.apple" | while read line; do
  echo "[!] $line"
done

echo "[*] 6. 检查 SSH 登录失败"
failed=$(log show --predicate 'process == "sshd"' --last 24h | grep -c "Failed")
if [ "$failed" -gt 10 ]; then
  echo "[!] SSH 登录失败次数过多: $failed"
fi

echo "[*] 7. 检查异常 TCC 权限"
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client FROM access WHERE allowed = 1 AND client NOT LIKE 'com.apple.%';"

echo "[*] 8. 检查最近安装的应用"
find /Applications -maxdepth 2 -name "*.app" -mtime -7 -exec ls -ld {} \;

echo "[*] 9. 检查环境变量异常"
if echo "$PATH" | grep -q "/tmp\|/var/tmp"; then
  echo "[!] PATH 包含可疑目录"
fi

echo "[*] 10. 检查防火墙状态"
if ! /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate | grep -q "enabled"; then
  echo "[!] 防火墙已禁用"
fi

rule macOS_Persistence_LaunchAgent {
    meta:
        description = "检测可疑 LaunchAgent"
        author = "Security Team"
    strings:
        $plist = "<?xml"
        $runatload = "RunAtLoad"
        $keepalive = "KeepAlive"
        $suspicious_path = "/tmp/" nocase
        $suspicious_path2 = "/var/tmp/" nocase
    condition:
        $plist and ($runatload or $keepalive) and ($suspicious_path or $suspicious_path2)
}

rule macOS_Quarantine_Removal {
    meta:
        description = "检测隔离属性移除"
        author = "Security Team"
    strings:
        $cmd1 = "xattr -d com.apple.quarantine"
        $cmd2 = "xattr -cr"
    condition:
        $cmd1 or $cmd2
}

SELECT name, path, program_arguments, run_at_load FROM launchd WHERE path NOT LIKE '/System/%';
SELECT filename, path, source FROM etc_services WHERE port > 1024;
SELECT pid, name, path, cmdline FROM processes WHERE path NOT LIKE '/System/%' AND path NOT LIKE '/usr/%';
SELECT user, host, port, type FROM listening_ports WHERE address != '127.0.0.1';
SELECT path, md5, sha256 FROM file WHERE path LIKE '/Applications/%';

/usr/bin/log stream --style ndjson | /usr/local/bin/forward_to_siem

[packs]
macos_security = /usr/local/share/osquery/packs/macos_security.conf

/Library/Application Support/agent/agent.sh
~/Library/LaunchAgents/com.apple.xptask.plist

文件：
- /Library/Application Support/agent/agent.sh
- ~/Library/LaunchAgents/com.apple.xptask.plist

网络：
- updates.silver-sparrow.com
- 185.x.x.x:443

行为：
- 创建 LaunchAgent
- 定期连接 C2
- 自更新机制

~/Library/LaunchAgents/com.apple.flashplayer.plist
/Library/Application Support/FlashPlayer/

文件：
- ~/Library/LaunchAgents/com.apple.flashplayer.plist
- /Library/Application Support/FlashPlayer/

网络：
- flashplayer-update.com
- cdn.flashplayer-update.net

行为：
- 键盘记录
- 浏览器凭据窃取
- 屏幕截图