Defending Against CrashStealer macOS Malware and Mobile Surveillance Operations

---
title: Suspicious macOS Launch Agent Creation
id: 1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects creation of suspicious Launch Agents which are commonly used for malware persistence on macOS
references:
  - https://attack.mitre.org/techniques/T1543/004/
author: Security Arsenal
date: 2026/04/28
tags:
  - attack.persistence
  - attack.t1543.004
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
      - '~/Library/LaunchAgents/'
  filter:
    Image|contains:
      - '/usr/sbin/installer'
      - '/usr/bin/xcodebuild'
  condition: selection and not filter
falsepositives:
  - Legitimate software installations
level: medium
---
title: macOS Keychain Access by Suspicious Process
id: 2b3c4d5e-6f7g-8h9i-0j1k-2l3m4n5o6p7q
status: experimental
description: Detects processes attempting to access macOS Keychain data, a common behavior for information stealers
references:
  - https://attack.mitre.org/techniques/T1055/
author: Security Arsenal
date: 2026/04/28
tags:
  - attack.credential_access
  - attack.t1055
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
      - 'security'
      - 'find-generic-password'
      - 'find-internet-password'
  filter:
    Image|contains:
      - '/usr/bin/security'
      - '/Applications/'
  condition: selection and not filter
falsepositives:
  - Legitimate password manager access
level: high
---
title: Suspicious Network Connection from macOS System Process
id: 3c4d5e6f-7g8h-9i0j-1k2l-3m4n5o6p7q8r
status: experimental
description: Detects unusual network connections from processes that shouldn't typically establish external connections
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/28
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    Image|contains:
      - '/Library/LaunchAgents/'
      - '/tmp/'
      - '/private/var/tmp/'
    DestinationPort:
      - 443
      - 8080
      - 8443
  condition: selection
falsepositives:
  - Legitimate software update connections
level: medium

// Hunt for suspicious Launch Agent creation on macOS
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("LaunchAgents", "LaunchDaemons")
| where ActionType == "FileCreated"
| where InitiatingProcessFolderPath !contains "/usr/sbin/installer"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc


// Detect potential macOS keychain access by unauthorized processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("find-generic-password", "find-internet-password", "dump-keychain")
| where ProcessVersionInfoOriginalFileName != "security"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by Timestamp desc

-- Hunt for suspicious Launch Agents on macOS
SELECT FullPath, Mtime, Size, Mode, User
FROM glob(globs='/*/*/LaunchAgents/*.plist', root='/')
WHERE Mtime > now() - 7*24*60*60

-- Find processes accessing keychain
SELECT Pid, Name, Exe, CommandLine, StartTime
FROM pslist()
WHERE CommandLine =~ 'security' AND CommandLine =~ 'find-'

-- Identify network connections from suspicious paths
SELECT Fd, Family, RemoteAddr, State, Pid, Name
FROM netstat()
WHERE Name =~ '/tmp/' OR Name =~ '/Library/LaunchAgents/'

#!/bin/bash
# macOS CrashStealer Detection and Remediation Script
# Security Arsenal - 2026

# Create log file
LOG_FILE="/var/log/macos_security_scan_$(date +%Y%m%d_%H%M%S).log"
echo "Starting macOS Security Scan at $(date)" | tee -a "$LOG_FILE"

# Function to check and report suspicious Launch Agents
check_launch_agents() {
    echo "Checking for suspicious Launch Agents..." | tee -a "$LOG_FILE"
    
    # Check system Launch Agents
    find /Library/LaunchAgents /Library/LaunchDaemons -name "*.plist" -mtime -7 2>/dev/null | while read file; do
        echo "[!] Recently modified: $file" | tee -a "$LOG_FILE"
        /usr/bin/plutil -p "$file" 2>/dev/null | tee -a "$LOG_FILE"
    done
    
    # Check user Launch Agents
    find /Users/*/Library/LaunchAgents -name "*.plist" -mtime -7 2>/dev/null | while read file; do
        echo "[!] Recently modified: $file" | tee -a "$LOG_FILE"
        /usr/bin/plutil -p "$file" 2>/dev/null | tee -a "$LOG_FILE"
    done
}

# Function to check for processes accessing keychain
check_keychain_access() {
    echo "Checking for suspicious keychain access..." | tee -a "$LOG_FILE"
    
    ps aux | grep -i "security.*find-" | grep -v grep | tee -a "$LOG_FILE"
}

# Function to check for suspicious network connections
check_network_connections() {
    echo "Checking for suspicious network connections..." | tee -a "$LOG_FILE"
    
    lsof -i -P -n | grep -i "established" | grep -v "ESTABLISHED" | tee -a "$LOG_FILE"
}

# Run all checks
check_launch_agents
check_keychain_access
check_network_connections

echo "Scan completed at $(date)" | tee -a "$LOG_FILE"
echo "Log saved to: $LOG_FILE"