Logging and detection

A firewall that blocks nothing and logs nothing is only half a defense. Detection is the other half: noticing when something on the machine is behaving in a way that does not fit. On one Mac, this does not require a security operations center, but it does require knowing what a normal connection looks like well enough to notice an abnormal one.

What is worth logging

On a single computer, the useful log categories mirror what a larger network operations center would track, just scaled down: which apps made which connections, to which destinations, and when; which apps ran, and whether they were signed by a known developer; and changes to security-relevant settings such as the firewall or Gatekeeper. macOS itself keeps a unified log covering system and app events, viewable in the Console app or with log show, and the Application Firewall’s own decisions are recorded there too. What most people are missing is not logging exactly, since macOS already logs a great deal, but a readable view of outbound connections specifically, since that is the direction a compromise is most likely to show up in first.

Reading connection logs: what normal looks like

A connection log is only useful once you have a rough sense of what is normal for a given app: a browser making frequent connections to many different domains is expected; a note-taking app doing the same is not. The three details worth noting for any connection are the destination (a domain or IP address, and ideally who operates it), the timing (once, occasionally, or on a fixed interval), and the app responsible for it.

Indicator: beaconing

Beaconing is a repeated, often precisely timed, outbound connection used by software to check in with a remote server, sometimes to receive further instructions. MITRE’s ATT&CK framework describes this pattern of application-layer command-and-control traffic as something defenders look for specifically through “beacon-like intervals”: regular timing that a normal user-driven app, which connects when you use it and stays quiet otherwise, would not produce. A single app quietly connecting out to the same address every few minutes, around the clock, whether or not you are using it, is the kind of pattern worth investigating rather than dismissing.

Indicator: DNS anomalies

Every domain name lookup passes through DNS before a connection is even made, which makes DNS traffic a useful place to look for oddities: an app resolving an unusually long or randomly generated-looking domain name, a burst of lookups to domains you do not recognize, or DNS queries at a volume and shape that does not match normal browsing. Cloudflare’s explanation of DNS tunneling describes one reason this happens: encoding data inside DNS queries and responses can be used to move information in or out of a network past controls that only inspect ordinary web traffic. You do not need to fully diagnose the technique yourself; noticing that DNS activity from a particular app looks unusual is enough reason to look closer or ask for help.

Indicator: unsigned binaries

Every legitimate Mac app is expected to be code-signed, and most are also notarized (covered in this site’s macOS hardening course). You can check whether a specific app is signed from Terminal:

$ codesign -dv --verbose=4 /Applications/SomeApp.app
Executable=/Applications/SomeApp.app/Contents/MacOS/SomeApp
Identifier=com.example.someapp
...

An app that is not signed at all, or whose identifier does not match what you expect for that app, is worth treating with suspicion, particularly if it also appears in the process list making network connections you cannot explain. This is a read-only check: it inspects a signature, it does not run or change the app.

IDS/IPS, at a personal scale

An intrusion detection system (IDS) watches traffic and raises an alert on suspicious patterns; an intrusion prevention system (IPS) goes further and blocks the traffic automatically. Enterprise versions of these compare traffic against large, maintained sets of known attack signatures and behavioral models. On one Mac, a per-app firewall that flags a new or unusual destination and lets you decide functions as a lightweight, personal version of the same idea: detection, with the option to act, at the scale of one machine rather than a whole network.