Our second 4pm Lightning Talk is Billy Gibson and Ryan Conry presenting "Bad Apples: Orchestrating Movement and Execution via Native macOS Protocols". "As macOS adoption accelerates—with over 45% of enterprises now utilizing the platform—Mac endpoints have become high-value targets for attackers seeking cloud credentials, source code, and privileged access. Despite this trend, macOS lateral movement remains a significant blind spot; the MITRE ATT&CK framework documents far fewer techniques for macOS than for Windows, and recent industry reports indicate that macOS environments prevent significantly fewer attacks than their Linux or Windows counterparts. This research aims to close that gap by systematically validating macOS-native lateral movement and execution primitives. While Remote Apple Events (RAE) are traditionally documented as a lateral movement vector (T1021.001), we also approach the protocol through the lens of Software Deployment Tools for Execution (T1072). We demonstrate how RAE can be weaponized as a standalone primitive for deploying and executing complex, multi-line shell scripts. Our investigation analyzes the inherent security features of the System Events handler and the parsing constraints of the AppleScript interpreter that typically restrict remote orchestration. We then present a robust bypass methodology utilizing Base64 transport encoding and Terminal.app orchestration to achieve arbitrary code execution. This research also validates a broad catalog of macOS-native lateral tool transfer (T1570) techniques. One novel approach demonstrates how RAE can abuse Finder file metadata to stage arbitrary payloads on a remote host. Additionally, this talk covers practical transfer methods using SMB, SCP, SFTP, git over SSH, SNMP traps, unprivileged TFTP configurations and socat-based channels are analyzed for their utility in establishing interactive shells and file transfer. Finally, combining SSH with osascript unlocks full remote AppleScript execution (T1059.002), effectively bypassing Apple’s intentional security features. Finally, we provide detection logic suggestions applicable to various security engines and SIEMs. By illuminating these native pathways, this research provides defenders with the technical understanding necessary to prioritize detection efforts on a platform that can no longer be overlooked."