Manish wrote about bypassing macOS EDR in-memory execution detections, and how to catch binaries trying to do just that (hint: yara).

Apple removing kexts really hurt security tools on this platform, and they haven't made up for that loss

https://rtx.meta.security/post-exploitation/2022/12/19/In-Memory-Execution-in-macOS.html