Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here. The post Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered appeared first on Unit 42 . Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Insights General General Tra…

https://unit42.paloaltonetworks.com/new-macos-artifact-discovered

sha256:85e4c5c57b904a8909307874a22355076c0f89dadfe3c2d06e4bdf2898a8fe2d

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url0
ipv40
ipv65
sha10
domain2
sha2560
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
ip	18:32:37	Open →
ip	18:36:59	Open →
ip	18:37:54	Open →
ip	18:38:19	Open →
ip	18:38:41	Open →
domain	app.menuitem	Open →
domain	outputfilename.txt

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports