| name | macos-postexploit |
| description | macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools |
| category | post-exploitation |
| tags | ["macos","post-exploitation","credential-access","defense-evasion","keychain","dtrace","tcc","xprotect","gatekeeper"] |
| tech_stack | ["macos","security-cli","dtrace","osascript","sqlite3","xattr"] |
| cwe_ids | ["CWE-269","CWE-522","CWE-693","CWE-312"] |
| chains_with | ["T1555.001","T1056.001","T1059.004","T1562.001","T1070.002","T1553.001"] |
| prerequisites | ["T1068","T1548"] |
| version | 1.0 |
macOS Post-Exploitation Methodology
macOS post-exploitation uses native tools (security, dtrace, xattr, log), Python with PyObjC/Quartz frameworks, and direct SQLite access for credential extraction. After gaining root or user-level access on a macOS target, these tools provide credential harvesting, runtime monitoring, and operational security capabilities.
Prerequisites
Before deploying machook tools, verify:
- Root access — most operations require root (except
xprotect_check, gatekeeper_bypass for user-owned files, ssh_keys for current user)
- SIP status — DTrace tools require SIP disabled (
csrutil disable from Recovery Mode)
- No Python needed — all tools use native macOS CLI (security, sqlite3, dtrace, xattr, osascript, log)
csrutil status
sw_vers
security list-keychains
which sqlite3
ls /Library/Apple/System/Library/CoreServices/XProtect.bundle
Kill Chain Phases
Phase 1 — Situational Awareness (First 60 seconds)
Understand the defensive landscape before deploying hooks.
| Action | Command | Purpose |
|---|
| Check XProtect | machook xprotect_check | Enumerate XProtect/MRT signatures to know what triggers detection |
| Check SIP | csrutil status | Determine if DTrace monitoring is available |
| SSH keys | machook ssh_keys | Find SSH private keys — often leads to lateral movement |
| Keychain list | security list-keychains | See available keychains before dumping |
