macos:other
Other macOS sources (fsevents, plists, launchd, TCC, MDM)
- Host type
- macOS
- Cost class
- Free tool
- Techniques
- 51
- Rules listed
- 0
- Events
- 0
Licensing
- License or service
- North Pole Security Santa (Apache 2.0)
- What is free
- All
- What costs
- Workshop control plane (demo-request; pricing not stated)
- Vendor page
- https://northpole.security/santa
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
- T1003 OS Credential Dumping
- T1005 Data from Local System
- T1014 Rootkit
- T1020 Automated Exfiltration
- T1025 Data from Removable Media
- T1027.001 Binary Padding
- T1027.006 HTML Smuggling
- T1027.014 Polymorphic Code
- T1027.015 Compression
- T1029 Scheduled Transfer
- T1036.002 Right-to-Left Override
- T1036.005 Match Legitimate Resource Name or Location
- T1036.006 Space after Filename
- T1036.009 Break Process Trees
- T1037 Boot or Logon Initialization Scripts
- T1037.002 Login Hook
- T1037.004 RC Scripts
- T1037.005 Startup Items
- T1039 Data from Network Shared Drive
- T1040 Network Sniffing
- T1052 Exfiltration Over Physical Medium
- T1052.001 Exfiltration over USB
- T1053 Scheduled Task/Job
- T1053.002 At
- T1053.003 Cron
- T1056.003 Web Portal Capture
- T1056.004 Credential API Hooking
- T1070 Indicator Removal
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1072 Software Deployment Tools
- T1080 Taint Shared Content
- T1083 File and Directory Discovery
- T1092 Communication Through Removable Media
- T1098.004 SSH Authorized Keys
- T1114.003 Email Forwarding Rule
- T1123 Audio Capture
- T1201 Password Policy Discovery
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1222 File and Directory Permissions Modification
- T1222.002 Linux and Mac Permissions
- T1480.001 Environmental Keying
- T1539 Steal Web Session Cookie
- T1543 Create or Modify System Process
- T1543.001 Launch Agent
- T1543.004 Launch Daemon
- T1548 Abuse Elevation Control Mechanism
- T1649 Steal or Forge Authentication Certificates
- T1667 Email Bombing
- T1685.006 Clear Linux or Mac System Logs
Rules
No vendor rule names this event or source directly.
Events
No event-level rows: this source is tiered as a whole.