/inspect-macos-runtime-activity

name: inspect-macos-runtime-activity
description: Correlate suspicious macOS process, file, network, permission, and log activity. Use for unexpected processes, downloads, open files, DNS, privacy prompts, alerts, file mutations, injected executables, and Endpoint Security evidence.

Inspect macOS Runtime Activity

Overview

Build a time-correlated view of what ran, what changed, and what communicated. Prefer focused native observations and existing telemetry over installing a broad privileged monitor on an affected host.

Read [references/macos-runtime-evidence.md](references/macos-runtime-evidence.md) for telemetry sources and permission boundaries.

Workflow

1. Fix host/build, user/session, time window, process/artifact identity, and reported symptom.

• Label every observation as physical-host, affected-host, or macOS-guest evidence. For a guest, record VM tool/framework, virtual hardware, restore-image/build, shares/devices/network, baseline/reset state, and virtualization artifacts that may alter behavior.

2. Capture current process context.

• Record PID, executable path/hash/signature, user, parent/ancestry, arguments, environment when authorized, start time, code state, and deleted/replaced executable clues.

3. Correlate files and registrations.

• Record open files, working directory, mapped images, created/modified paths, quarantine/provenance, persistence registrations, and permission failures.

4. Correlate network behavior.

• Record process-to-socket mapping, local/remote endpoints, DNS, protocol clues, timing, and whether a connection completed.

5. Inspect focused logs/events.

• Query relevant unified logs and existing Endpoint Security/XProtect/Gatekeeper evidence for the narrow time window.
• Record Full Disk Access, root, Endpoint Security entitlement, or other permissions required and what absence hides.
• Treat missing collection permission or unavailable event types as a telemetry gap, not evidence that the behavior did not occur. Route app-facing permission implementation to `macos-privacy-permissions-workflow` and exact private-control interpretation to `research-macos-security-control`.

6. Build a timeline.

• Separate user action, launch, child processes, file changes, prompts, network, persistence, detection, and termination.

7. Assess behavior and gaps.

• Route binary internals, dynamic reproduction, containment, or hunting as needed.
• State anti-VM, hardware, Secure Enclave, recoveryOS, kernel/system-extension, and device-access limitations before treating guest evidence as physical-Mac proof.

Output

Return process identity/ancestry, file/network/log timeline, permissions and coverage, observed versus inferred behavior, confidence, and next action.