Comment on A terminal window periodically flashes on my screen every few minutes. It goes away in one second. I have no idea what it is, nor how to stop it.

<- View Parent
t3rmit3@beehaw.org ⁨10⁩ ⁨months⁩ ago

Most of the IR that I do is within corporate production environments, so I can answer this with the tools I would use for Linux incident response, but there will be areas like Kernel Extensions that are MacOS-specific, which I don’t have IR experience in, and can’t speak to. Assume that sudo permissions are required for these. Also not that I’m not including commands to look for active user intrusions, just binary implantation like malware. Active human intrusion blows up the amount of places and things to check for, and for regular users who don’t have regulatory reporting requirements, you’re better off just restoring from a backup.

There is apparently also a tool made by Apple called sysdiagnose that you can run to basically do a large-scale debug dump of your system, including lots of data about applications and processes. I can’t claim any personal experience with this, but this guide (and part 2 here) go into using it to hunt for malware.

source
Sort:hotnewtop