Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered
ID: 7e008cf4-6d0a-53b6-a38c-561d5f4ebb9a
STIX ID: report--7e008cf4-6d0a-53b6-a38c-561d5f4ebb9a
Feed Name: Palo Alto Networks Unit 42
This report details the discovery of a new Apple Biome stream, App.MenuItem, in macOS Tahoe 26 that logs precise user menu selections and timestamps; it documents the artifact's filesystem location, SEGB/protobuf structure, recommended parsing steps (using ccl-segb and conversion to CSV), example event sequences showing user intent (e.g., compressing then deleting a folder), and limitations where menu text may not reveal targets, positioning the artifact as a valuable forensic source rather than evidence of malicious activity.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.