CoreAnalytics

Overview

CoreAnalytics is the diagnostic telemetry pipeline Apple uses to understand how macOS is performing on customer machines. The same data — kept for ~28 days on the host — is forensically valuable: it records which apps launched, how often, for how long, and which crashed. It's a quiet record of execution that often survives even when more obvious artifacts have been wiped.

Analysis Tips

• Daily aggregation: Events are bucketed by day, not per-launch, so use it for pattern-of-life rather than precise timestamps
• Process names and bundle IDs: Cross-reference suspicious bundle IDs with Persistence and TCC artifacts
• Crash counts: Repeated crashes for an unsigned binary often indicate failed exploitation or an unstable implant
• Daemon usage: Daemons that "phone home" appear here even when their on-disk presence is well-hidden

Related Artifacts

• Pattern of Life - KnowledgeC and Biome capture the same execution context with finer granularity
• Unified Logs - launchd subsystem logs each process spawn
• Persistence Mechanisms - Confirm whether observed processes correspond to installed agents

References

• SANS macOS Forensics — CoreAnalytics
• mac4n6.com — CoreAnalytics deep-dive