Weaponizing Vtables: Detection Engineering for Kernel-Space Exploits in macOS by Olivia Gallucci

Weaponizing Vtables: Detection Engineering for Kernel-Space Exploits in macOS by Olivia Gallucci Overview: macOS kernel drivers use C++ virtual method tables (vtables) as part of their object model via IOKit. These vtables are a longstanding attack vector: once corrupted, they enable arbitrary control flow through forged function pointers. This talk explores vtable structure and misuse in the macOS kernel space, focusing on exploitation methods, Apple's hardening (PAC, kalloc_type), and how threat detection engineering can surface this low-level abuse. We connect kernel vtable abuse to runtime behavior, showing detection opportunities and implementation strategies using macOS telemetry APIs and instrumentation. Descriptive: This session explores exploiting virtual method tables (vtables) in the macOS kernel (via IOKit) and how to detect these techniques as they occur. We'll explore how kernel objects are structured, how use-after-free and fake vtable techniques bypass runtime protections, some CVEs, and how Pointer Authentication (PAC) plays a role in this. Then, we will transition into detection engineering: how hijacked vtables manifest in kernel crashes, syscall behavior, and memory layout anomalies. We'll walk through detection strategies, including PAC failure crash signatures, Endpoint Security API telemetry, and architectural approaches like hypervisor-assisted integrity monitoring. Designed for engineers building telemetry pipelines or writing detection rules, this talk bridges internals and exploitation knowledge with security tooling.