The following is an example from the macOS Unified Log showing a kickstart command used by an attacker to enable remote desktop access for all users with all privileges: Figure 1: Kickstart command exampleĭuring an investigation, you can use a few different artifacts to trace this activity. This allowed remote desktop access to the target systems. If remote desktop was not enabled on a target system, Mandiant observed attackers connecting to systems via SSH and executing a kickstart command to enable remote desktop management. Mandiant has observed attackers using the ARD screen sharing function to move laterally between systems. In a typical enterprise environment deployment, managers would be the ARD administrators and have the ability to view, manage, and remotely control their managed personnel’s workstations via ARD. Client systems must be added to the client list on an administrator system manually, or they can be discovered via Bonjour if they are in the same local subnet as the administrator system.

While the administrator app must be downloaded from the macOS App Store, the client application is included natively as part of macOS. An ARD deployment consists of administrator and client machines. In recent enterprise macOS investigations, FireEye Mandiant identified the Apple Remote Desktop application as a lateral movement vector and as a source for valuable forensic artifacts.Īpple Remote Desktop (ARD) was first released in 2002 and is Apple’s “desktop management system for software distribution, asset management, and remote assistance”. But what about when that land is an Apple orchard? This tactic is often referred to as Living Off The Land. Leveraging these applications assists them with blending in with normal network activity and removes the need to develop or bring their own malware. Create a Free Mandiant Advantage AccountĪttackers often make their lives easier by relying on pre-existing operating system and third party applications in an enterprise environment.

Noteholder and Preferred Shareholder Documents.

Remote management service mac