macOS detection engineering has had a documentation problem for years. Everyone told Olivia Gallucci she was locking herself into a platform nobody cared about. Then infostealers showed up, enterprise Mac fleets exploded, and suddenly her work was the most in-demand research nobody knew existed.

Olivia is a security engineer at Datadog living inside macOS internals...from Apple Silicon boot chain to ESF event families to IOKit abuse....and she is single-handedly dragging macOS DE into the light.

In this episode we get into:

• Why you can't just flag osascript anymore and what to look at instead
• The process tree trap that trips up every Windows-native DE who crosses over
• Background Task Management: the persistence metadata everyone's sleeping on
• Living off the Orchard binaries
• Why your EDR is abstracting macOS telemetry from you and what to do about it
• Jonathan Levin's books, Jaron Bradley's Sprite Tree, and the resources that actually matter

Follow Olivia's work on:

• oliviagallucci.com | [ret]2read — An OS Internals Newsletter (Substack)
• LinkedIn: linkedin.com/in/olivia-gallucci
• 2026 main stage at BlackHat

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.