> For those who want to check if they're Mac has been infected, Red Canary provides indicators of compromise at the end of its report.
At the end of https://redcanary.com/blog/clipping-silver-sparrows-wings/
At the end of https://redcanary.com/blog/clipping-silver-sparrows-wings/
For even more protection, I flat out locked the folders ~/Library/LaunchAgents and ~/Library/LaunchDaemons in Finder, though this could interfere with some software you use.
https://www.peterborgapps.com/lingon/
https://www.peterborgapps.com/lingon/#preferencesnotificatio...
Also, Little Snitch will show you the connections it makes every hour. Before anyone says it - in macOS 11.2, Apple removed the exclusion list that allowed their own software to bypass firewalls.[1]
> ~/Library/._insu (empty file used to signal the malware to delete itself)
> /tmp/agent.sh (shell script executed for installation callback)
> /tmp/version.json (file downloaded from from S3 to determine execution flow)
> /tmp/version.plist (version.json converted into a property list)