aol.pm

OSX/Shlayer

Software · ATTACK:enterprise:S0402

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0402",
  "title": "OSX/Shlayer",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0402",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--f1314e75-ada8-49f4-b281-b1fb8b48f2a7",
  "external_id": "S0402",
  "domain": "enterprise",
  "created": "2019-08-29T18:52:20.879Z",
  "modified": "2025-04-16T20:38:42.935Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "OSX/Shlayer"
    },
    {
      "source_name": "Crossrider"
    },
    {
      "source_name": "Zshlayer"
    },
    {
      "source_name": "Carbon Black Shlayer Feb 2019",
      "url": "https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html"
    },
    {
      "source_name": "Intego Shlayer Feb 2018",
      "url": "https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/"
    },
    {
      "source_name": "sentinelone shlayer to zshlayer",
      "url": "https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/"
    },
    {
      "source_name": "Malwarebytes Crossrider Apr 2018",
      "url": "https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/"
    },
    {
      "source_name": "Intego Shlayer Apr 2018",
      "url": "https://www.intego.com/mac-security-blog/new-osxshlayer-malware-variant-found-using-a-dirty-new-trick/"
    }
  ]
}

Explicit source assertions (15)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08e05216-9133-4056-bbc9-b91ea0a7c6f5

Shlayer jamf gatekeeper bypass 2021 · sentinelone shlayer to zshlayer · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b967933-da99-40a4-9bd5-e8238e8d46c3

Carbon Black Shlayer Feb 2019

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1222.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--544cc12a-53c4-4a56-b480-bfc79beee93c

Carbon Black Shlayer Feb 2019 · Shlayer jamf gatekeeper bypass 2021 · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--557288c3-8463-4900-b2e5-aa9856d428cd

Carbon Black Shlayer Feb 2019 · Intego Shlayer Feb 2018

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1176.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b5b5650-916b-4519-8cbd-da90589fe7b6

Malwarebytes Crossrider Apr 2018 · Intego Shlayer Apr 2018

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1553.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60a6f8ce-1ee6-4770-8d83-9c2717d53fc3

Carbon Black Shlayer Feb 2019 · Shlayer jamf gatekeeper bypass 2021 · objectivesee osx.shlayer apple approved 2020

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ea74151-62ea-462e-988e-7704db70ec87

Carbon Black Shlayer Feb 2019 · objectivesee osx.shlayer apple approved 2020 · sentinelone shlayer to zshlayer · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1564.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a012427-6f85-45b5-b1b2-439c72f7efb4

Shlayer jamf gatekeeper bypass 2021

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a2fbf8a-a05c-44d7-a270-afe092de9db5

Carbon Black Shlayer Feb 2019 · sentinelone shlayer to zshlayer · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f8d2b41-acb9-4fdf-ad90-c59fd6fad882

Carbon Black Shlayer Feb 2019 · Intego Shlayer Feb 2018

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1564.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--950fca51-66e4-43c6-9af0-839e962b8409

tau bundlore erika noerenberg 2020 · sentinellabs resource named fork 2020

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cbfc2f6-0b87-402c-b536-2d9688b2e0ea

sentinelone shlayer to zshlayer · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9db842bf-d65d-44a8-93ca-aef62cadafc1

Carbon Black Shlayer Feb 2019 · sentinelone shlayer to zshlayer

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd79d063-3407-4da9-b6d1-6170a3b9edfc

Carbon Black Shlayer Feb 2019 · objectivesee osx.shlayer apple approved 2020 · sentinelone shlayer to zshlayer · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1548.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9d727db-88ac-4729-bf8a-98d99a83534d

Carbon Black Shlayer Feb 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.