Skip to content
View Brandon7CC's full-sized avatar
🌉
🌉
46 followers · 34 following

Achievements

Achievement: Pull Sharkx3Achievement: Pair ExtraordinaireAchievement: QuickdrawAchievement: YOLOAchievement: Arctic Code Vault Contributor

Achievements

Achievement: Pull Sharkx3Achievement: Pair ExtraordinaireAchievement: QuickdrawAchievement: YOLOAchievement: Arctic Code Vault Contributor

Organizations

@Mass-IG

Block or report Brandon7CC

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Please don't include any personal information such as legal names or email addresses. Maximum 100 characters, markdown supported. This note will be visible to only you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Brandon7CC/README.md

Hi there 👋

My personal security blog is hosted on Notion at: swiftly-detecting.notion.site.

Some helpful links

Recent content

📝 ES Gatekeeper User Override

Summary: Apple has introduced a new Endpoint Security (ES) event in macOS 15 Sequoia called ES_EVENT_TYPE_NOTIFY_GATEKEEPER_USER_OVERRIDE, providing insight into Gatekeeper user overrides. This event, emitted by the /usr/libexec/syspolicyd daemon, does not enable authorization, but offers details like file type, path, CD hash, and SHA256 hash for files under 100MB. The event can be leveraged to detect instances where users bypass Gatekeeper restrictions, aiding in incident response and threat detection. Additionally, the ExecPolicy database's policy_scan_cache and settings table can be queried for the last override event by looking to the lastGKOverride value.

📝 Listing Connected ES Clients

Summary: It's possible to enumerate Endpoint Security (ES) clients (those who call into es_new_client(_:_:)) using the I/O Registry. The I/O Registry is a database representing the system's current "hardware" configuration and is organized into eight planes, with the IOService plane being of particular interest. The native ioreg utility can be used to query the EndpointSecurityDriver node, revealing connected ES clients as EndpointSecurityExternalClient objects. Additionally, Apple's IORegistryExplorer.app offers a graphical view of connected clients.

Pinned Loading

  1. redcanaryco/mac-monitor redcanaryco/mac-monitor Public

    Red Canary Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research. Beginning with Endpoint Security (ES), it collects and enriches system events, dis…

    Swift 966 47

  2. mac-wheres-my-bootstrap mac-wheres-my-bootstrap Public

    Detect common classes of XPC exploits

    Swift 3 1

  3. Aura Aura Public

    Mythic iOS agent.

    Objective-C

  4. redcanaryco/AtomicTestHarnesses redcanaryco/AtomicTestHarnesses Public

    Public Repo for Atomic Test Harness

    PowerShell 258 46

  5. SimpleMacStats SimpleMacStats Public

    A simple macOS system monitor.

    Swift 1