Leveraging Apple's Game Engine to Detect Threats
Explore a comprehensive approach to detecting Mac malware using behavior-based monitoring and Apple's game engine in this RSA Conference talk. Dive into current macOS threats, monitoring capabilities, and the innovative use of Apple's GameplayKit for cybersecurity. Learn about an open-source monitoring framework that passively collects system events and a rule-based system leveraging Apple's game engine for efficient threat detection. Discover how to develop "Game Plans" for detecting persistence methods, chain logic blocks for more accurate detection, and conduct threat hunting using predicates. Gain insights into process, file, synthetic click, and camera/microphone monitoring techniques. Understand the potential of this extensible detection, response, and threat hunting platform for comprehensive Mac security.