Lion Cipher Lab
Reconstruct a macOS intrusion from Unified Logs and FSEvents
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Macs are now a first-class target -- in the enterprise, and especially among developers and executives who hold the keys to everything. But most DFIR training is Windows or Linux, so when a mac alert fires, responders reach for artifacts that do not exist on macOS and freeze. The two artifacts that actually carry a macOS intrusion are the Apple Unified Log (a single structured firehose of process, subsystem, and network events that replaced the old text syslog) and FSEvents (a compact, always-on record under /.fseventsd of which directories changed). Each alone is misleading: the Unified Log…
What you'll learn
- the macOS forensic artifact map: what the Apple Unified Log records (structured process/subsystem/PID events) vs what FSEvents records (coarse, coalesced, per-directory file-change history under /.fseventsd)
- the exact real commands a responder runs on a live Mac -- log show --style ndjson --predicate ... for the Unified Log, and copying + parsing /.fseventsd into CSV for FSEvents
- seeing WHY a naive keyword grep fails: grepping the process name and 'curl' finds 4 lines (all the payload's own chatter) and misses the persistence and the C2 entirely
- building a CORRELATED analysis that joins the Unified Log by process tree, PID, and suspect file path -- then cross-references FSEvents file creations under ~/Library/LaunchAgents to rebuild the full intrusion chain
- extracting the concrete IOCs a report needs: the LaunchAgent persistence plist path and the C2 host:port, with accurate first-seen/last-seen timestamps
- mapping the chain to MITRE ATT&CK for macOS: Launch Agent (T1543.001), Login Items (T1547.015), and AppleScript (T1059.002)
- reasoning around the honest limits: short Unified Log retention leaves a GAP, FSEvents is coalesced so it proves a directory changed but not the write order, <private> redaction hides arguments, and TCC/SIP bound what is recorded -- so absence of evidence is not evidence of absence
Steps in this lab
- The macOS artifact map -- and why this data is synthetic
- The real commands -- what you'd run on a live Mac
- Generate the synthetic case
- The naive move -- grep the Unified Log for what you were told
- Why grep fails, and what correlation actually does
- Run the correlation -- the chain assembles
- Map the chain to ATT&CK -- so the report speaks IR
- The honest negatives -- where each artifact lies to you
- When to reach for this -- and the reflex to keep