05 · Execution & Persistence
Quarantine Events and Gatekeeper: Tracing Mac Downloads
Decode the com.apple.quarantine xattr, query QuarantineEventsV2, and use spctl, codesign and unified logs to trace downloads and Gatekeeper decisions.
Read guide
05 · Evidence area
Execution & Persistence
Most Mac intrusions start with a download and end with a launchd job. Follow a file from the com.apple.quarantine attribute and QuarantineEventsV2 through Gatekeeper assessment to the LaunchAgent, LaunchDaemon or Background Task Management entry that keeps it alive.
- com.apple.quarantine
- QuarantineEventsV2
- LaunchAgents
- sfltool dumpbtm
2 guides in this area
05 · Execution & Persistence
Investigating launchd Persistence on macOS
Find and analyze macOS persistence: LaunchAgents, LaunchDaemons, launchctl, Background Task Management (sfltool dumpbtm), cron, periodic and profiles.
Read guide
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- QuarantineEventsV2 and Quarantine xattr on macOSQuarantineEventsV2 and the com.apple.quarantine attribute record what was downloaded, from which URL, by which app and when, often after the file is gone.
- Gatekeeper and XProtect Evidence on macOSGatekeeper, XProtect and XProtect Remediator leave log entries and databases that show which code was assessed, approved, flagged or removed.
- LaunchAgents and LaunchDaemons: macOS Persistencelaunchd property lists in LaunchAgents and LaunchDaemons folders define what macOS starts at boot, at login or on a schedule, and are the top persistence spot.
- Login Items and BTM Database on macOSLogin Items and the Ventura+ Background Task Management store list login items, agents and daemons, with developer, team ID and approval state.
- cron, at and periodic: macOS Scheduled Job PersistenceLegacy macOS schedulers (cron tabs, at jobs, periodic scripts, emond rules): where they live, which versions still run them and how to spot abuse.
- InstallHistory.plist: macOS Software Install LogInstallHistory.plist and the package receipt database show which apps, packages and system updates were installed on a Mac, by which process and when.
- Shell History on macOS: zsh, bash and Terminal SessionsmacOS shell history in .zsh_history, .bash_history and Terminal's per-window session files: which commands a user typed and roughly when.
- sudo Logs: macOS Privilege Escalation Evidencesudo events in macOS Unified Logs, the sudoers configuration and the /var/db/sudo timestamp files show who ran which commands as root, and when.
- Crash Reports: macOS DiagnosticReports (.ips)macOS crash and diagnostic reports record which binary crashed, its path, parent, signing identity, launch and crash time, even for malware.
- Kernel and System Extensions: macOS kext EvidenceKernel extensions and system extensions on macOS: KextPolicy load history, the SystemExtensions database and what they show about drivers, EDR and rootkits.
- Configuration Profiles and MDM: macOS Managed SettingsmacOS configuration profiles and MDM enrollment records show which policies, certificates, VPNs, TCC grants and extensions were pushed to a Mac, and when.
- Mounted Disk Images on macOS: DMG, ISO and App TranslocationHow to prove a DMG or ISO was downloaded, mounted and used on a Mac: quarantine, Unified Logs, FSEvents, App Translocation paths and Spotlight.
- SSH and Remote Login on macOS: Keys, Hosts and LogsmacOS Remote Login (sshd) leaves authorized_keys, known_hosts, sshd configuration and Unified Log events that show inbound and outbound SSH activity.
- Screen Sharing and Apple Remote Desktop ArtifactsmacOS Screen Sharing and Apple Remote Desktop leave connection history, screensharingd log events and ARD caches that show remote control of a Mac.
- netusage.sqlite: macOS Per-Process Network Usagenetusage.sqlite records which processes used the network on a Mac, with first and last seen times and bytes over Wi-Fi, wired and cellular links.