Malicious Streams

Identifying Persistence on Mac OS X

The need to persist tools and infections between reboots is critical for the cyber criminal. In the Microsoft Windows world, we have an established body of knowledge and tools for determining programs set to launch at startup. This same level of maturity does not exist for the Mac OS X platform. Even though details of OS X’s startup systems have been widely published, there is a lack of dissemination of this information within the Forensics community. Further, there exists a gap in open source tools to aid in the compilation of OS X startup items. The intent of this article is to explore the startup mechanisms of OS X and to introduce a basic tool to help with the examination of Mac OS X systems.
Read Article