# Create a virtual environment
python3 -m venv detection_env
source detection_env/bin/activate

# Install necessary libraries
# watchdog: For monitoring filesystem changes
# psutil: For monitoring system processes
pip install watchdog psutil requests

# Initialize project
mkdir mac-security-monitor && cd mac-security-monitor
npm init -y

# Install dependencies
# child_process is native, but we'll use standard patterns
npm install typescript ts-node @types/node --save-dev

import psutil
import time
import logging

# Configure logging for security auditing
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - [SECURITY_ALERT] - %(message)s'
)

# List of "High Risk" processes that shouldn't be spawned by web services or unexpected users
SUSPICIOUS_PROCESSES = ['nc', 'ncat', 'python3', 'bash', 'zsh', 'perl', 'ruby']

def monitor_processes():
    """
    Scans running processes and flags suspicious shell activity.
    """
    print("[*] Starting macOS Process Security Monitor...")
    print(f"[*] Monitoring for: {SUSPICIOUS_PROCESSES}")
    
    seen_pids = set()

    try:
        while True:
            for proc in psutil.process_iter(['pid', 'name', 'username']):
                try:
                    pid = proc.info['pid']
                    name = proc.info['name']
                    user = proc.info['username']

                    # Logic: If a process in our suspicious list is running 
                    # and is not a standard system process (simplified logic)
                    if name in SUSPICIOUS_PROCESSES and pid not in seen_pids:
                        logging.warning(f"Suspicious process detected! Name: {name}, PID: {pid}, User: {user}")
                        # In a real scenario, trigger a webhook to a SOC here
                        seen_pids.add(pid)
                        
                except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
                    continue
            
            time.sleep(2)  # Check every 2 seconds to reduce CPU overhead
    except KeyboardInterrupt:
        print("\n[*] Monitoring stopped by administrator.")

if __name__ == "__main__":
    monitor_processes()

import { exec } from 'child_process';
import * as fs from 'fs';
import * as path from 'path';

/**
 * Interface for Security Alerts
 */
interface SecurityAlert {
    timestamp: string;
    event: string;
    filePath: string;
    severity: 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
}

class FileIntegrityMonitor {
    private watchPath: string;

    constructor(path: string) {
        this.watchPath = path;
    }

    /**
     * Logs an alert to the console and could be extended to send to an API
     */
    private logAlert(alert: SecurityAlert) {
        console.error(`\x1b[31m[${alert.timestamp}] [${alert.severity}] ${alert.event}: ${alert.filePath}\x1b[0m`);
    }

    /**
     * Initializes the watcher using macOS 'fswatch' or native fs
     */
    public start() {
        console.log(`[*] Monitoring filesystem integrity at: ${this.watchPath}`);
        
        // Using native fs.watch for demonstration
        // Note: In production, use 'fswatch' for better performance on macOS
        fs.watch(this.watchPath, (eventType, filename) => {
            if (filename) {
                const fullPath = path.join(this.watchPath, filename);
                this.inspectFile(fullPath);
            }
        });
    }

    private inspectFile(filePath: string) {
        try {
            // Check if the new file is an executable
            const stats = fs.statSync(filePath);
            const isExecutable = (stats.mode & 0o111)!== 0;

            if (isExecutable) {
                const alert: SecurityAlert = {
                    timestamp: new Date().toISOString(),
                    event: 'UNAUTHORIZED_EXECUTABLE_CREATED',
                    filePath: filePath,
                    severity: 'CRITICAL'
                };
                this.logAlert(alert);
            }
        } catch (err) {
            // File might have been deleted immediately after creation
            return;
        }
    }
}

// --- Execution ---
const monitor = new FileIntegrityMonitor('/tmp'); // Monitoring /tmp as it's a common landing zone
monitor.start();

# Security API Configuration
SOC_ENDPOINT_URL=https://api.your-soc.com/v1/alerts
SOC_API_KEY=sk_live_your_secret_key_here

# Monitoring Thresholds
DETECTION_SENSITIVITY=HIGH
LOG_LEVEL=DEBUG

import os
from dotenv import load_dotenv

load_dotenv()
API_KEY = os.getenv('SOC_API_KEY')