---

MacNoise

MacNoise generates real macOS activity for EDR validation and detection engineering. Run individual modules or YAML scenarios to exercise network connections, file writes, process execution, persistence, TCC access, and other behaviors against your security controls.

For background on the motivation and design, see the release blog post.

Before you run

MacNoise is intended for authorized security testing on systems you own or have explicit written permission to test. Modules perform the real activity they describe. They are not sandboxed, and some actions can irreversibly delete or alter system and user data. Review module behavior and dry-run output before execution. You are responsible for target selection, authorization, and consequences. The authors assume no liability for misuse.

Quick start

Build from a checkout with Go 1.24 or later and Make:

make build

Run the binary on macOS. To cross-compile, use make build-amd64 for Intel Macs, make build-arm64 for Apple silicon, or make release for both.

List modules and inspect the one you want to run:

./macnoise list
./macnoise info file_create

Preview the parameters, then execute the same command without --dry-run:

./macnoise run file_create --param count=1 --dry-run
./macnoise run file_create --param count=1

The second command creates a file, emits telemetry, and runs cleanup. To preview a connected sequence of modules:

./macnoise scenario configs/scenarios/file_flow.yaml --dry-run

Run scenarios to connect module outputs, capture output for analysis, or retain artifacts for later scans.

Find a module

The generated module catalog lists every module, parameter, output, event type, privilege, and ATT&CK mapping. Category guides explain platform requirements and module behavior:

Category	Description
network	TCP connections, HTTP, listeners, reverse shells, DNS, and TLS
process	Execution, signal delivery, dylib injection, Gatekeeper bypass, and osascript
file	Discovery, reads, copies, creation, modification, archiving, hiding, and decoy encryption
tcc	Full Disk Access, Contacts, Accessibility, and Screen Recording probes
credential	Native credential-store access
volume	Disk-image creation and mounted-volume lifecycle
service	Launchd enumeration, LaunchAgent and LaunchDaemon persistence, cron, shell profiles, and Login Items
plist	Plist creation and modification
evasion	Log clearing, timestomping, history removal, and masquerading

Use ./macnoise list --category network to filter the list. To execute a category or every registered module, use ./macnoise run --category network or ./macnoise run --all.

Commands

macnoise run <module> [--param key=val ...]   Run a specific module
macnoise run --category <cat>                 Run all modules in a category
macnoise run --all                            Run all modules
macnoise list [--category <cat>]              List modules
macnoise info <module>                        Show module details, params, MITRE
macnoise scenario <file.yaml> [--input key=val] [--report report.json]
                                                Run a YAML scenario
macnoise categories                           List categories with counts
macnoise version                              Print version

Global flags

Flag	Default	Description
--format	human	Output format: human or jsonl
--output	(none)	Write output to file (in addition to stdout)
--verbose	false	Currently accepted without changing output
--dry-run	false	Preview actions without executing
--no-cleanup	false	Retain artifacts after execution
--timeout	30	Per-module timeout in seconds. 0 disables the timeout
--audit-log	(none)	Write OCSF 1.7.0 audit records to a JSONL file
--config	(none)	Load defaults from a YAML config file
--run-id	generated	Set the correlation identifier for this run

Retain artifacts

By default, MacNoise runs module cleanup after execution. Cleanup removes artifacts that the invocation created and still owns. It cannot reverse completed network, process, or destructive activity.

To validate that your stack detects persistence itself, leave the artifact in place while the scan runs. Examples include a LaunchAgent in ~/Library/LaunchAgents, a cron entry, and a modified shell profile:

./macnoise run svc_launch_agent --no-cleanup

Each module that skips cleanup prints a diagnostic, and the audit log records cleanup_result: skipped. Use the module catalog and category guides to review the artifacts a module creates.

You are responsible for removing these yourself. Re-running the same module without the flag will clean up only what that run created, not what a previous --no-cleanup run left behind.

Capture output and audit records

MacNoise emits its own descriptions of attempted actions to stdout. Your security controls collect their own telemetry from the activity on the host. Use --format jsonl for structured MacNoise events and --output to append a copy to a file:

./macnoise scenario configs/scenarios/file_flow.yaml --format jsonl --output /tmp/events.jsonl

Add --audit-log to record module execution, prerequisite and cleanup outcomes, and MITRE mappings in OCSF 1.7.0 JSONL:

./macnoise scenario configs/scenarios/file_flow.yaml --audit-log /tmp/audit.jsonl

Run identifiers, previews, and cleanup diagnostics go to stderr. Every telemetry event carries an outcome and one typed subject in schema 2.0. The subject identifies the file, process, network endpoint, service, or resource involved:

outcome	Meaning	Human marker
executed	The action ran and did what the module claims	[+]
denied	The action ran and the environment refused it	[-]
indeterminate	The action ran, but nothing can be concluded	[?]
error	MacNoise itself failed to carry the action out	[!]