https://github.com/osquery/osquery logo
#general
Title
# general
s

Santosh Shiv

12/08/2021, 6:34 PM
Hi - Need help! Can anyone guide me on how I can retrieve anti virus info on the mac (darwin os). For windows, I was able to fetch the info from the windows_security_products. Not seeing the same for mac. Thanks in advance!
f

fritz

12/08/2021, 7:30 PM
No such table exists on macOS because no such concept exists in macOS. The API leveraged on Windows is available because security products register themselves with the Windows Security Center API. On macOS there is no central security registration API which would serve as a reasonable analogue.
The closest thing would be to look for System Extensions which are built on the Endpoint Security framework.
t

Tor Houghton

12/08/2021, 9:15 PM
Some products don't register there (com.objective-see.blockblock and com.objective-see.ransomwhere for example); but can be found in the launchd table - you could perhaps look for non-disabled entries? (Or look for related items in the processes table?)
Obviously you would have to know the name of the products and what they register as..
f

fritz

12/08/2021, 9:54 PM
Correct, on macOS there is not a good canonical way to look for the presence of security software
short of writing/maintaining a custom query that searches known locations/datasources
j

Jason

12/09/2021, 2:17 AM
I personally look for my desired process running.
A fun project would be to gather canonical process names for all Mac AV software and provide a cannned query for this.
f

fritz

12/10/2021, 5:30 PM
@Jason I think we have different personal meanings for the term 'fun project' 😉
j

Jason

12/10/2021, 6:04 PM
People tell me that all the time :)
5 Views