https://x7peeps.com/tags/Santa/index.htmlHugozh-CNThu, 09 Jul 2026 11:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/macOS%E6%8C%81%E4%B9%85%E5%8C%96%E6%9C%BA%E5%88%B6%E4%B8%8E%E6%A3%80%E6%B5%8B%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.htmlThu, 09 Jul 2026 11:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/macOS%E6%8C%81%E4%B9%85%E5%8C%96%E6%9C%BA%E5%88%B6%E4%B8%8E%E6%A3%80%E6%B5%8B%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.html系统剖析macOS平台特有的持久化机制，涵盖LaunchDaemon与LaunchAgent全家桶、LoginItem与SMAppService、Profiles配置管理与MDM持久化、TCC数据库权限持久化、Gatekeeper绕过与ad-hoc签名、内核扩展与System Extension、crontab与at持久化，结合Santa/osquery/EndpointSecurity框架提供自动化检测方案