BlockBlock
BlockBlock copied to clipboard
Persistence installed before detection
When malware installs persistence (tested with https://github.com/neoneggplant/EggShell), the script is loaded into memory before detection and blocking. It is persistent as long as the user does not reboot.
@Spl01ter have you possibly checked to see if this is still the case with 2.0.3?
It is still the case
I am now testing with https://github.com/RPwnage/EggShell-Community-Fork
![Screen Shot 2021-04-15 at 1 36 09 PM](https://user-images.githubusercontent.com/36258159/114819129-8b046e00-9def-11eb-9b50-390834af6050.png)
![Screen Shot 2021-04-15 at 1 36 35 PM](https://user-images.githubusercontent.com/36258159/114819158-9a83b700-9def-11eb-8756-73fd5a653164.png)
Will clarify, but this is by design.
macOS delivers events (such as file events) via the Endpoint Security Framework
.
BlockBlock subscribes to the ES_EVENT_TYPE_NOTIFY_WRITE
event which (as you have noted), is delivered after the event ...it's a notification event. While there are ES_EVENT_TYPE_AUTH*
events (that are delivered before the event occurs), there is no ES_EVENT_TYPE_AUTH_WRITE
...and BlockBlock needs a write event, so we can examine what was added.