DEF CON 33 - Mastering Apple Endpoint Security for Advanced macOS Malware Detection - Patrick Wardle

Five years after Apple radically empowered third-party security developers on macOS with the introduction of Endpoint Security, most developers grasp its fundamentals, but subtle nuances remain, and advanced features are still underutilized. And as the framework continues to evolve, even experienced developers can struggle to keep pace with its rapidly expanding capabilities. This talk explores critical areas that frequently trip up developers, such as caching behaviors and authorization deadlines, before diving into Endpoint Security’s more advanced features like mute inversions. We'll also cover recently introduced capabilities—including the long-awaited TCC event monitoring which offer unprecedented visibility into permission-related activity often targeted by malware. Each topic will include practical code examples, demonstrated and validated against sophisticated macOS malware. Join us to move beyond the basics and unlock the full power of Apple's Endpoint Security framework.