Introducing MacNoise!

What it is

MacNoise, a modular macOS telemetry noise generator written in Go, released by 0xv1n. It emits real system events — network connections, DNS lookups, file writes, process spawns, process injection, plist/service mutations, and TCC permission probes — so defenders can confirm their EDR/SIEM/firewall actually records them. Repo: https://github.com/0xv1n/macnoise.

How it works

It ships as a cross-platform binary with a REPL. Modules are grouped into categories and each carries MITRE technique mappings viewable via macnoise info <module>. Two output streams are kept distinct:

• Telemetry events — TelemetryEvent records to stdout (or --output <file>); this is what your tooling is supposed to see.
• Audit records — a separate structured log of what MacNoise itself did (modules run, prereq outcomes, timing, events emitted, cleanup, MITRE mappings), meant to be sent to the SIEM to confirm each run.

Both streams are OCSF JSONL; MacNoise-specific fields sit in the OCSF unmapped object to stay schema-compliant. Audit runs are tagged with correlation IDs, so you can pivot per-module in the SIEM to pinpoint which event types went unlogged.

What to do

Core commands:

macnoise run <module> [--param key=val ...]   Run a specific module
macnoise run --category <cat>                 Run all modules in a category
macnoise run --all                            Run all modules
macnoise list [--category <cat>]              List modules
macnoise info <module>                        Show module details, params, MITRE
macnoise scenario <file.yaml>                 Run a YAML scenario
macnoise categories                           List categories with counts

Preview without emitting telemetry, and capture the audit trail, with:

--dry-run
--audit-log

Scenarios chain modules to emulate adversary tradecraft. A step references a module plus params, e.g. proc_spawn, proc_inject (dylib_path, target), net_connect (target, port), net_dns (domains), file_create, svc_launch_agent, tcc_fda, tcc_contacts. The repo bundles sample scenarios including an "EDR Validation Suite." Scenario YAML can be generated by feeding a threat-intel report plus the repo's "AI Guidance" doc to an LLM.

Caveats

The author states coverage is not feature complete — telemetry breadth depends on community contributions and their own time. The tool validates logging gaps; it does not remediate them. Process injection and TCC probing modules perform real actions (e.g. writing a dylib to /tmp, launch agents), so use --dry-run first to eye-check behavior before running against production endpoints.