OSXCollector: Forensic Collection and Automated Analysis for OS X

-
Ivan L., Engineering Manager - Security
- Jan 12, 2015
Introducing OSXCollector We use Macs a lot at Yelp, which means that we see our fair share of Mac-specific security alerts. Host based detectors will tell us about known malware infestations or weird new startup items. Network based detectors see potential C2 callouts or DNS requests to resolve suspicious domains. Sometimes our awesome employees just let us know, “I think I have like Stuxnet or conficker or something on my laptop.” When alerts fire, our incident response team’s first goal is to “stop the bleeding” - to contain and then eradicate the threat. Next, we move to “root cause the...