Alerting for suspicious file access on macOS
On macOS, there are a couple of ways to monitor file access. There is OpenBSM. The Basic Security Module (BSM) was originally created by Sun Microsystems and can be used for auditing. There are also tracing utilities such as fs_usage. In this section, we will explore multiple ways to monitor access to decoy files.
To get started, go ahead and create two decoy files with interesting names that might trick an adversary who is poking around your machines:
$ echo "S3cr3tP@$$W0Rd!" > /Users/john/password.txt $ echo "S3cr3tP@$$W0Rd!" > /tmp/password.txt
The preceding commands will create two decoy files. We will set up monitoring for read access to these files later and trigger notifications when the file is being accessed. Now, let's explore how we can monitor access to these files. To get started, let's explore the fs_usage tool.
