Commonly referred to as behavioral analysis, running malware in a real or simulated environment with various monitors to track system changes can give a quick and valuable insight into malware functionality. In addition, it may be useful to change the behavior of the executed sample on the fly. Here are some of the most popular tools that make it possible on macOS:
- DTrace toolkit: A collection of tools that aim to monitor various system events. Here are some of the most popular ones:
- opensnoop: Allows us to monitor filesystem operations. An alternative to monitoring disk I/O events is iosnoop.
- execsnoop: Can be used to record process activity, for example, executed commands. Particularly useful for monitoring short-living processes.
- dtruss: Allows us to monitor syscall details as an alternative to strace on Linux.
- tcpsnoop: Can be used to map network traffic to particular processes and monitor accessed hosts and ports used.
- ProcInfo: This library...