Modern macOS Red Teaming Tactics | SO-CON 2025

Presented by Lance Cain and Craig Wright. A presentation covering the details of tradecraft, techniques, and tactics SpecterOps employs for performing red team assessments of client organizations with macOS deployments that bypass modern EDRs and macOS built-in security features, presented from the perspective of an Attack Path. Slides: https://github.com/SpecterOps/presentations/tree/main/SO-CON%202025/Lance%20Cain%20and%20Craig%20Wright%20-%20Modern%20macOS%20Red%20Teaming%20Tactics SO-CON: https://specterops.io/so-con This talk was recorded on Monday, March 31, 2025 at SO-CON 2025.