Create a JXA Safari.app stager on the desktop

/static/assets/apple-logo.svg
Create a persistence application that looks like Safari.app that will spawn a new beacon then launch Safari.app.
locked
View Command

To view this TTPs command, you must be logged in with a professional or enterprise license.

Login

Test this TTP

Download Operator (1.7.0)
Test this TTP using one of our Operator chains
JXA Access

2021-08-24

/static/assets/apple-logo.svg
Use JXA to load a file-less agent into memory and create persistence mechanisms on OS X.