MacPmem enables read/write access to physical memory on macOS. Can be used by CSIRT teams and attackers.

Hunt Hypothesis

The detection identifies potential adversary use of MacPmem to gain read/write access to physical memory on macOS, which could be used for extracting sensitive data or persisting malicious payloads. SOC teams should proactively hunt for this behavior to identify advanced threats leveraging memory exploitation techniques in their Azure Sentinel environment.

YARA Rule

rule hacktool_macos_macpmem
{
    meta:
        description = "MacPmem enables read/write access to physical memory on macOS. Can be used by CSIRT teams and attackers."
        reference = "https://github.com/google/rekall/tree/master/tools/osx/MacPmem"
        author = "@mimeframe"
        id = "26ee217b-a3f3-5742-801e-cdc0684dfd99"
    strings:
        // osxpmem
        $a1 = "%s/MacPmem.kext" wide ascii
        $a2 = "The Pmem physical memory imager." wide ascii
        $a3 = "The OSXPmem memory imager." wide ascii
        $a4 = "These AFF4 Volumes will be loaded and their metadata will be parsed before the program runs." wide ascii
        $a5 = "Pmem driver version incompatible. Reported" wide ascii
        $a6 = "Memory access driver left loaded since you specified the -l flag." wide ascii
        // kext
        $b1 = "Unloading MacPmem" wide ascii
        $b2 = "MacPmem load tag is" wide ascii
    condition:
        MachO and 2 of ($a*) or all of ($b*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• https://github.com/google/rekall/tree/master/tools/osx/MacPmem
• Source Rule

False Positive Guidance

• Scenario: A system administrator is using Volatility or MacPmem to analyze memory dumps for forensic purposes.
  Filter/Exclusion: Check for presence of known forensic tools in the command line (e.g., volatility, macpmem) or process names in the event log.

• Scenario: A scheduled job runs pmem to capture memory for compliance or security audits.
  Filter/Exclusion: Exclude processes associated with known audit or compliance tools, or filter by user account (e.g., audit, compliance).

• Scenario: An IT admin is using pmem to troubleshoot application crashes by capturing memory dumps.
  Filter/Exclusion: Filter by process names related to troubleshooting (e.g., crash_dump, debugger) or user roles (e.g., itadmin).

• Scenario: A macOS update or system maintenance task temporarily enables pmem for system diagnostics.
  Filter/Exclusion: Exclude processes initiated by system services or scheduled tasks (e.g., launchd, cron), or filter by process parent process (e.g., launchd).

• Scenario: A developer is using pmem to debug memory-related issues in a macOS application.
  Filter/Exclusion: Filter by user account (e.g., developer) or process names related to development tools (e.g., gdb, lldb, xcode).