Introducing macOS Mirage: Next-Generation Apple Silicon Dynamic Analysis and Sigma Detections

In November 2015, we released our first in-house macOS sandbox, Box of Apples , followed by an update in March 2018 that introduced HTML behavior reports, desktop screenshots, and process trees. Over the past decade, the macOS ecosystem and the threat landscape targeting it have changed dramatically. Apple transitioned its hardware architecture from Intel ( x86_64 ) to Apple Silicon ( ARM64 ), hardened its operating system security model, and deprecated legacy dynamic tracing mechanisms.