macOS Screen Sharing Exploit & Monero Miner Triage Workbench

Unified Log & Incident Source

Incident Presets (One-Click Scenarios)

Raw macOS Unified Log Stream / Event Log

Remediation Hardening Options

Kill miner PIDs (-9) Bootout launchd plist Shred binary & plists Disable Screen Sharing Block Stratum TCP in pfctl Flush Directory Service Auth

Incident Verdict CONFIRMED_REMOTE_SCREEN_SHARING_EXPLOIT_AND_MINER_INJECTION

Detected IOCs 4

Miner Binary /private/tmp/.xmrig_sys

Stratum Pool pool.supportxmr.com:3333

Persistence Plist /Library/LaunchDaemons/com.apple.systemupdate.plist

Interactive Attack Chain & Execution Topology Node drag enabled • Live physics layout

Type	Indicator / Artifact	Confidence	Context / MITRE ATT&CK