macOS
internals The fleet most FinTechs actually run, and the platform most security engineers know least well. Different persistence, different logging, a permission system Windows has no equivalent for, and an EDR agent that operates under Apple's rules rather than its own.

/System            Apple only. Sealed, read-only (SSV) since Big Sur.
/Library           system-wide config, agents, daemons, extensions
~/Library          per-user equivalent — persistence hides here
/Applications      app bundles (.app = a directory, not a file)
/usr/local, /opt   Homebrew and third-party CLI tools
/private/var/log   legacy text logs (mostly superseded)
/tmp, /var/folders staging areas for droppers

An app bundle is a folder: Foo.app/Contents/MacOS/Foo is the executable, Info.plist the metadata. Malware frequently ships as a bundle with a document icon.

Property lists (plists) are the config format — XML or binary. Read them with plutil -p file.plist, since binary plists look like noise in a text editor.

Quarantine attribute — anything downloaded by a browser or mail client gets the extended attribute com.apple.quarantine. That flag is what triggers Gatekeeper and notarisation checks. Check it with xattr -l file; malware often removes it, and that removal is itself detectable.

/Library/LaunchDaemons     runs as root at boot, no user needed
/Library/LaunchAgents      runs as any user at login
~/Library/LaunchAgents     runs for that user — no admin rights required!
/System/Library/Launch*    Apple only, SIP-protected

A malicious agent is a small plist with Label, ProgramArguments, and RunAtLoad or StartInterval. Because ~/Library/LaunchAgents is user-writable, commodity macOS malware needs no privilege escalation to persist.

# enumerate
launchctl list
ls -la ~/Library/LaunchAgents /Library/Launch{Agents,Daemons}
plutil -p ~/Library/LaunchAgents/com.suspicious.updater.plist

Other persistence to sweep

• Login items — modern ones registered by apps (sfltool dumpbtm, and the Background Task Management database).
• Configuration profiles — profiles list; a rogue profile can install certificates or lock settings.
• Cron / at — legacy but functional.
• Shell rc files — ~/.zshrc, ~/.zprofile for anything that starts a terminal.
• Dylib hijacking — an app loading a library from a writable path.
• Kernel/System extensions — rare now, and highly visible: user approval plus MDM.

Apple replaced text syslog with the unified log — a compressed, structured, memory-and-disk store queried with the log command. Much of it is ephemeral and private-redacted, which surprises people expecting Windows-style durable event logs.

log show --last 1h --predicate 'process == "sudo"'
log stream --predicate 'eventMessage CONTAINS "quarantine"'
log show --last 24h --predicate 'subsystem == "com.apple.TCC"'

Endpoint Security (ES) framework is the sanctioned API that EDR agents — SentinelOne included — use to subscribe to process exec, file, and mount events in kernel-adjacent user space, replacing the old kernel extensions. Consequences: agents need explicit MDM approval (a PPPC profile granting Full Disk Access and system extension permission), and if that profile is missing the agent installs but sees almost nothing.

• Fake app installers / cracked software — DMGs with instructions to right-click-open (defeating Gatekeeper by design) or to paste a curl | bash line into Terminal.
• Infostealers (Atomic Stealer and relatives) — grab browser cookies, keychain items via a fake password prompt, crypto wallets, then exit. Fast, non-persistent, financially motivated. The fake osascript password dialog is the signature move: osascript -e 'display dialog "macOS needs your password"'.
• Malicious profiles / MDM abuse — installing a configuration profile to add a trusted CA or proxy.
• TCC social engineering — prompting the user to grant Screen Recording or Accessibility, which then permits keystroke capture and screen capture legitimately.
• Living off the land — curl, osascript, launchctl, defaults, xattr -d, base64, python3.

# high-signal command lines to detect
osascript -e 'display dialog ... with hidden answer'   fake password prompt
xattr -d com.apple.quarantine /path/app                Gatekeeper evasion
curl -fsSL http... | bash                              remote script exec
security find-generic-password -w                      keychain access
csrutil disable                                        SIP tampering

• Automated Device Enrolment (via Apple Business Manager) so enrolment is supervised and non-removable — the difference between a managed device and a device with an agent someone can uninstall.
• FileVault enforced with escrowed recovery keys.
• PPPC profile granting the EDR and any DLP/steering client the access they need, pushed before the agent.
• Firewall + stealth mode, Gatekeeper enforced, automatic security updates and Rapid Security Responses enabled.
• Local admin removed for standard users, with a break-glass account; guest disabled.
• Baseline against CIS Benchmarks for macOS, with drift reporting — this is what turns "we manage Macs" into an auditable statement.