A Little Less Malware, A Little More Context: Using LLMs to Detect Malicious macOS Activity

No ratings

Presented at Objective by the Sea 2024 by

Kimo Bumanglag

Joseph Millman

Large language models (LLM) are being incorporated into many applications including security. In this talk, we will explore an approach to detecting malicious macOS activity by using an LLM to triage command line activity. You may have heard of prompt engineering to produce better LLM output. To use LLMs in detection, you also want more context. We'll show some ways to pair common endpoint telemetry from macOS systems with additional information about the endpoint and its user to create more context. This method lets us build abstract detections that can detect behavior that is typically missed by static methods, such as obfuscated commands and masquerading.