Spelunking macOS Telemetry

Last week I had the pleasure of speaking at the London Apple Admins meetup.

My talk was a short walk through how a single command leaves a trail of Endpoint Security events, and how to follow that trail back to build detections that survive the attacker swapping out domains and filenames.

The recording is now up on YouTube: https://lnkd.in/e2xE2evK

Slides are on my GitHub: https://lnkd.in/ekxYM8-9

Thanks to everyone who came out. Special thanks to London Apple Admins for organizing! ❤️

https://londonappleadmins.org.uk/2026/08/15/watch-the-video-13th-august-meet-up-iru/