macOS Terms and Trends You Should Know About

This post recaps a Tradecraft Tuesday conversation on macOS security, highlighting Apple’s Background Task Management (BTM) database as a key persistence hub, how to inspect it (e.g., sfltool dumpbtm), and how Endpoint Security events (ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD/REMOVE) provide visibility into changes. It briefly surveys recent macOS malware trends (e.g., ransomware, RustBucket, adware families) amid Apple’s hardening measures (code signing, notarization, TCC) and concludes with a concise glossary of macOS security terms and components relevant to defenders.