Writing about Security, AI, and other curiosities.
The final piece: somewhere to send your logs and build detections. We'll set up a Splunk Attack Range, connect your macOS VM, and walk through the detection development workflow.
Now for the fun part — getting telemetry out of your macOS VM. This is where macOS detection engineering has historically been painful, but Apple's Endpoint Security Framework (ESF) has changed the game.
Running macOS on Proxmox opens up your detection lab to Intel server hardware. This is ideal if you want a dedicated always-on lab environment separate from your daily driver. **Legal note:** Apple's macOS EULA generally restricts use to Apple-branded hardware. Running macOS on non-Apple hardware (including Proxmox/KVM) is a gray area — review the current Software License Agreement yourself and accept the legal risk. This post is for personal detection-lab learning only, not production or redistribution.
If you have a Mac (especially Apple Silicon), running macOS VMs is surprisingly easy. Apple actually supports macOS virtualization natively now via the Virtualization.framework. This post covers three options — pick the one that fits your workflow.
MacOS detection engineering is the neglected middle child of the security world. While Windows gets all the love with tools like Sysmon, comprehensive event logging, and mature detection frameworks, macOS defenders are often left cobbling together solutions from scattered documentation and tribal knowledge.This series walks through building a proper macOS detection lab — from spinning up macOS VMs to shipping logs to Splunk for detection development. By the end, you'll have a repeatable environment for building, testing, and validating macOS detections.
How to detect exploitation of CVE-2024-32002, a remote code execution vulnerability in Git that allows malicious repositories to execute code just by cloning.
A curated reading list on detection engineering best practices, tooling, and methodologies for building scalable security content.
A collection of principles I've found helpful over the years.
My workflow for managing the constant fire hose of information in cybersecurity using Readwise Reader, Beeper, and Obsidian.
9 posts total