Detecting and Mitigating the GateKeeper User Override on macOS in an Enterprise Environment — For red teamers, social engineering a macOS user into executing an application is a common way to gain code execution on a remote macOS client machine. Apple’s development of their macOS built-in security mechanism, GateKeeper, has made this a more difficult task, but not impossible. It is effortless for a…

A New Mitigation Strategy for the most used macOS Persistence Technique — Why Launch Persistence Research? This research started with me looking for suggestions for my organization on mitigating launch persistence techniques for macOS. As a red team operator, sharing knowledge and recommendations with our security organizations is crucial to making our customers safer. I took a look at the macOS MITRE ATT&CK matrix for the…

Observing Your macOS Red Team attack footprint like an EDR with a HELK Lab — As you run your red team attack in a macOS environment, you might find yourself wondering what your blue team is seeing from their Endpoint Detection & Response (EDR) solution. In this article, I will explain how to build a lab using the following three components. You can use it…

Introducing Conf-Thief — I don’t have to explain to the experienced Red Teamer the treasure trove of secrets and intelligence data that can be found in the pages of an organization's Confluence instance. If the Red Teamer finds herself on a victim’s Confluence site this could mean finding secrets and sensitive data that…

Introducing G-Dir Thief What is this about? During the last few Red Team Operations I’ve been on, I’ve found myself having phished my way into a victim’s G-Suite account. Among other things, I end up taking a look at the victim’s Google contacts and ultimately look at the victim organization’s Google directory. While you…

Introducing a tool for exfiltrating all of the things from a Google Drive I am a Master’s of Information Security Engineering student at SANS Technology Institute (STI). I was doing my reading the other night for my SEC 530: Defensible Security Architecture and Engineering course and got into the topics…

Enumerating TCC.db with JXA — After reading a Tweet from Wojciech Reguła (@_r3ggi), sharing 3 articles from F-Secure Labs’ blog posts concerning bypassing MacOS’ Transparency, Consent and Control (TCC) by Luke Roberts (@rookuu_) and Calum Hall (@_calumhall), my colleagues Christopher Ross (@xorrior), Andy Grant (@andywgrant), and I took part in some discussion concerning the topic.

How to get your electron app to do Mac stuff. — So, this story begins with me deciding that I wanted to develop a standalone app that can make MacOS Native API calls for purposes that I will not dive into, just yet (I plan to develop the app and do not know yet, how well it will pan out in…

Are you really going there? Yes, I am aware that attempting to answer the question “What is red teaming?” within the infosec community is a topic that tends to ruffle the feathers and stirs the pot for my red team peers, but I am writing this article anyway. I am writing this, because I have…