Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples

This report examines macOS lateral movement techniques—SSH key theft and persistence via authorized_keys, misuse of Apple Remote Desktop (ARD), and Remote Apple Events (RAE)—with real-world examples (ZuRu, PyTorch dependency confusion, SSH‑Snake, Insekt) and actionable detection guidance. It highlights how attackers enable and leverage ARD (kickstart, ardagent, screensharingd over ports like 3283) and RAE (eppc over port 3031) to execute commands, exfiltrate data, and maintain persistence, and it recommends monitoring key file changes, suspicious process trees, relevant Unified Log predicates, and network activity to detect and disrupt these techniques.