Venator

Venator is a python tool used for gathering data for the purpose of proactive macOS detection. Support for High Sierra & Mojave using native macOS python version (2.7.x). Happy Hunting!

Below are the Venator modules and the data each module contains. Once the script is complete, you will be provided a JSON file for further analysis/ingestion into a SIEM solution. You can search for data by the module in the following way within the JSON file: module:<name of module>

system_info:

• hostname
• kernel
• kernel_release

launch_agents:

• label
• program
• program_arguments
• signing_info
• hash
• executable
• plist_hash
• path
• runAtLoad
• hostname

launch_daemons:

• label
• program
• program_arguments
• signing_info
• hash
• executable
• plist_hash
• path
• runAtLoad
• hostname

users:

• users
• hostname

safari_extensions:

• extension name
• apple_signed
• developer_identifier
• extension_path
• hostname

chrome_extensions:

• extension_directory_name
• extension_update_url
• extension_name
• hostname

firefox_extensions:

• extension_id
• extension_update_url
• extension_options_url
• extension_install_date
• extension_last_updated
• extension_source_uri
• extension_name
• extension_description
• extension_creator
• extension_homepage_url
• hostname

install_history:

• install_date
• display_name
• package_identifier
• hostname

cron_jobs:

• user
• crontab
• hostname

emond_rules:

• rule
• path
• hostname

environment_variables:

• hostname
• variable:value

periodic_scripts:

• hostname
• periodic_script:”content of script”

current_connections:

• process_name
• process_id
• user
• TCP_UDP
• connection_flow
• hostname

sip_status:

• sip_status
• hostname

gatekeeper_status:

• gatekeeper_status
• hostname

login_items:

• hostname
• application
• executable
• application_hash
• signature

applications:

• hostname
• application
• executable
• application_hash
• signature

event_taps:

• eventTapID
• tapping_process_id
• tapping_process_name
• tapped_process_id
• enabled
• hostname

bash_history:

• user
• bash_commands
• hostname

Download

git clone https://github.com/richiercyrus/Venator.git

Copyright (C) 2019 richiercyrus

Source: https://github.com/richiercyrus/