Skip to content

Commit 731e5ec

Browse files
deoktrdeoktr
committed
add: macos evasions
1 parent bb562fa commit 731e5ec

17 files changed

Lines changed: 1283 additions & 7 deletions

‎evasion.md‎

Lines changed: 280 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22

33
_Auto-generated documentation. Do not edit manually._
44

5-
**Total techniques**: 71
5+
**Total techniques**: 85
66

77
## Categories
88

9-
- [Debugger](#debugger) (7 techniques)
10-
- [Guardrails](#guardrails) (27 techniques)
11-
- [Sandbox](#sandbox) (28 techniques)
12-
- [Special](#special) (9 techniques)
9+
- [Debugger](#debugger) (8 techniques)
10+
- [Guardrails](#guardrails) (29 techniques)
11+
- [Sandbox](#sandbox) (38 techniques)
12+
- [Special](#special) (10 techniques)
1313

1414
---
1515

@@ -105,6 +105,26 @@ if (any (x in open ("/proc/"+str (os .getppid ())+"/comm").read ()for x in ["pyd
105105
print ("Hello, world!")
106106
```
107107

108+
### `MacDebugProcessEvasion`
109+
110+
- **Platform**: darwin
111+
- **Description**: Detects macOS debugging tools by parent process name
112+
113+
**Parameters**:
114+
115+
| Parameter | Type | Default |
116+
|---|---|---|
117+
| `debuggers` | `list[str] | None` | `None` |
118+
119+
**Example output**:
120+
121+
```python
122+
import subprocess ,os
123+
if (any (x in subprocess .check_output (['ps','-o','comm=','-p',str (os .getppid ())]).decode ()for x in ['lldb','dtrace','sample','spindump','leaks'])):
124+
raise Exception ('MacDebugProcessEvasion')
125+
print ("Hello, world!")
126+
```
127+
108128
### `TracemallocEvasion`
109129

110130
- **Platform**: any
@@ -301,7 +321,7 @@ print ("Hello, world!")
301321

302322
```python
303323
from datetime import datetime
304-
if (datetime .now ()>datetime (2026 ,4 ,5 ,16 ,36 ,10 )):
324+
if (datetime .now ()>datetime (2026 ,4 ,19 ,13 ,16 ,5 )):
305325
raise Exception ('ExpireEvasion')
306326
print ("Hello, world!")
307327
```
@@ -572,6 +592,46 @@ print ("Hello, world!")
572592
# Example not available: invalid literal for int() with base 16: 'example'
573593
```
574594

595+
### `MacSIPEvasion`
596+
597+
- **Platform**: darwin
598+
- **Description**: Checks macOS System Integrity Protection (SIP) status
599+
600+
**Parameters**:
601+
602+
| Parameter | Type | Default |
603+
|---|---|---|
604+
| `expected_enabled` | `bool` | `True` |
605+
606+
**Example output**:
607+
608+
```python
609+
import subprocess
610+
if ((b"enabled"in subprocess .check_output (['csrutil','status']))!=True ):
611+
raise Exception ('MacSIPEvasion')
612+
print ("Hello, world!")
613+
```
614+
615+
### `MacVersionEvasion`
616+
617+
- **Platform**: darwin
618+
- **Description**: Checks macOS version against a minimum version
619+
620+
**Parameters**:
621+
622+
| Parameter | Type | Default |
623+
|---|---|---|
624+
| `min_version` | `str` | `'11.0'` |
625+
626+
**Example output**:
627+
628+
```python
629+
import platform
630+
if (tuple (int (x )for x in platform .mac_ver ()[0 ].split ('.'))<tuple (int (x )for x in '11.0'.split ('.'))):
631+
raise Exception ('MacVersionEvasion')
632+
print ("Hello, world!")
633+
```
634+
575635
### `TimezoneEvasion`
576636

577637
- **Platform**: any
@@ -950,6 +1010,202 @@ if (float (Path ('/proc/uptime').read_text ().split ()[0 ])<720 ):
9501010
print ("Hello, world!")
9511011
```
9521012

1013+
### `MacDiskSizeEvasion`
1014+
1015+
- **Platform**: darwin
1016+
- **Description**: Detects small disk size on macOS indicating a sandbox VM
1017+
1018+
**Parameters**:
1019+
1020+
| Parameter | Type | Default |
1021+
|---|---|---|
1022+
| `min_disk` | `int` | `52428800` |
1023+
1024+
**Example output**:
1025+
1026+
```python
1027+
import subprocess
1028+
if (int (subprocess .check_output (['df','-k','/']).decode ().split ('\n')[1 ].split ()[1 ])<52428800 ):
1029+
raise Exception ('MacDiskSizeEvasion')
1030+
print ("Hello, world!")
1031+
```
1032+
1033+
### `MacEDREvasion`
1034+
1035+
- **Platform**: darwin
1036+
- **Description**: Detects EDR/security products via macOS process list
1037+
1038+
**Parameters**:
1039+
1040+
| Parameter | Type | Default |
1041+
|---|---|---|
1042+
| `edr_list` | `list[str] | None` | `None` |
1043+
1044+
**Example output**:
1045+
1046+
```python
1047+
import subprocess
1048+
if (any (e in subprocess .check_output (['ps','-eo','comm']).decode ().lower ()for e in ['cbosxsensorservice','cbdefense','sentinelagent','falcond','crowdstrike','malwarebytes','littlesnitch','lulu'])):
1049+
raise Exception ('MacEDREvasion')
1050+
print ("Hello, world!")
1051+
```
1052+
1053+
### `MacMouseEvasion`
1054+
1055+
- **Platform**: darwin
1056+
- **Description**: Detects absence of mouse/trackpad on macOS via IORegistry
1057+
1058+
**Parameters**:
1059+
1060+
_No parameters_
1061+
1062+
**Example output**:
1063+
1064+
```python
1065+
import subprocess
1066+
if (b"AppleHIDMouseDevice"not in subprocess .check_output (['ioreg','-c','AppleHIDMouseDevice','-r'])):
1067+
raise Exception ('MacMouseEvasion')
1068+
print ("Hello, world!")
1069+
```
1070+
1071+
### `MacProcessListEvasion`
1072+
1073+
- **Platform**: darwin
1074+
- **Description**: Detects known analysis tool processes on macOS
1075+
1076+
**Parameters**:
1077+
1078+
| Parameter | Type | Default |
1079+
|---|---|---|
1080+
| `process_list` | `list[str] | None` | `None` |
1081+
1082+
**Example output**:
1083+
1084+
```python
1085+
import subprocess
1086+
if (any (x in subprocess .check_output (['ps','-eo','comm']).decode ()for x in ['Wireshark','tcpdump','dtrace','lldb','fsmon','filemon','procmon','Instruments'])):
1087+
raise Exception ('MacProcessListEvasion')
1088+
print ("Hello, world!")
1089+
```
1090+
1091+
### `MacRAMCountEvasion`
1092+
1093+
- **Platform**: darwin
1094+
- **Description**: Detects low RAM on macOS indicating a sandbox VM
1095+
1096+
**Parameters**:
1097+
1098+
| Parameter | Type | Default |
1099+
|---|---|---|
1100+
| `min_ram` | `int` | `2147483648` |
1101+
1102+
**Example output**:
1103+
1104+
```python
1105+
import subprocess
1106+
if (int (subprocess .check_output (['sysctl','-n','hw.memsize']).strip ())<2147483648 ):
1107+
raise Exception ('MacRAMCountEvasion')
1108+
print ("Hello, world!")
1109+
```
1110+
1111+
### `MacSandboxArtifactEvasion`
1112+
1113+
- **Platform**: darwin
1114+
- **Description**: Detects known sandbox/VM artifact files on macOS
1115+
1116+
**Parameters**:
1117+
1118+
| Parameter | Type | Default |
1119+
|---|---|---|
1120+
| `artifacts` | `list[str] | None` | `None` |
1121+
1122+
**Example output**:
1123+
1124+
```python
1125+
import os
1126+
if (any (os .path .exists (a )for a in ['/Library/Parallels Guest Tools','/Library/Application Support/VMware Tools','/usr/local/bin/VBoxControl','/Library/LaunchDaemons/com.parallels.vm.prl_nettool.plist'])):
1127+
raise Exception ('MacSandboxArtifactEvasion')
1128+
print ("Hello, world!")
1129+
```
1130+
1131+
### `MacScreenResolutionEvasion`
1132+
1133+
- **Platform**: darwin
1134+
- **Description**: Detects low screen resolution on macOS indicating a headless sandbox
1135+
1136+
**Parameters**:
1137+
1138+
| Parameter | Type | Default |
1139+
|---|---|---|
1140+
| `min_width` | `int` | `1024` |
1141+
1142+
**Example output**:
1143+
1144+
```python
1145+
import subprocess
1146+
if (int (subprocess .check_output (['osascript','-e','tell application "Finder" to get bounds of window of desktop']).decode ().split (', ')[2 ])<1024 ):
1147+
raise Exception ('MacScreenResolutionEvasion')
1148+
print ("Hello, world!")
1149+
```
1150+
1151+
### `MacTmpCountEvasion`
1152+
1153+
- **Platform**: darwin
1154+
- **Description**: Detects low temp file count on macOS
1155+
1156+
**Parameters**:
1157+
1158+
| Parameter | Type | Default |
1159+
|---|---|---|
1160+
| `min_count` | `int` | `3` |
1161+
1162+
**Example output**:
1163+
1164+
```python
1165+
import os
1166+
if (len (os .listdir ('/private/tmp'))<3 ):
1167+
raise Exception ('MacTmpCountEvasion')
1168+
print ("Hello, world!")
1169+
```
1170+
1171+
### `MacUptimeEvasion`
1172+
1173+
- **Platform**: darwin
1174+
- **Description**: Detects low uptime on macOS indicating a recently booted sandbox
1175+
1176+
**Parameters**:
1177+
1178+
| Parameter | Type | Default |
1179+
|---|---|---|
1180+
| `min_uptime` | `int` | `600` |
1181+
1182+
**Example output**:
1183+
1184+
```python
1185+
import subprocess ,time
1186+
if (time .time ()-int (subprocess .check_output (['sysctl','-n','kern.boottime']).decode ().split ('sec = ')[1 ].split (',')[0 ])<600 ):
1187+
raise Exception ('MacUptimeEvasion')
1188+
print ("Hello, world!")
1189+
```
1190+
1191+
### `MacVMEvasion`
1192+
1193+
- **Platform**: darwin
1194+
- **Description**: Detects VM/hypervisor on macOS via sysctl CPU VMM flag
1195+
1196+
**Parameters**:
1197+
1198+
_No parameters_
1199+
1200+
**Example output**:
1201+
1202+
```python
1203+
import subprocess
1204+
if (b"VMM"in subprocess .check_output (['sysctl','-n','machdep.cpu.features'])):
1205+
raise Exception ('MacVMEvasion')
1206+
print ("Hello, world!")
1207+
```
1208+
9531209
### `SandboxHostnameEvasion`
9541210

9551211
- **Platform**: any
@@ -1335,6 +1591,24 @@ if (os .path .exists ("/proc/version")and "microsoft"in open ("/proc/version").r
13351591
print ("Hello, world!")
13361592
```
13371593

1594+
### `MacAppSandboxEvasion`
1595+
1596+
- **Platform**: darwin
1597+
- **Description**: Detects macOS App Sandbox environment
1598+
1599+
**Parameters**:
1600+
1601+
_No parameters_
1602+
1603+
**Example output**:
1604+
1605+
```python
1606+
import os
1607+
if (os .environ .get ('APP_SANDBOX_CONTAINER_ID')is not None ):
1608+
raise Exception ('MacAppSandboxEvasion')
1609+
print ("Hello, world!")
1610+
```
1611+
13381612
### `ServerlessEvasion`
13391613

13401614
- **Platform**: any

0 commit comments

Comments
 (0)