Comparing Mac EDR solutions

This post documents how I compared two Endpoint Detection and Response (EDR) products — SentinelOne and CrowdStrike — on macOS. I ran two sets of tests: a performance test (compiling Kubernetes to stress the engine), and a malware detection test (using the Objective-See Mac malware collection).

Background

SentinelOne is an EDR platform that provides enhanced anti-virus and anti-malware detection, as well as incident response to triage and remediate infections. An agent runs in the background of your computer and checks programs for malicious behaviour in real time.

Traditional anti-virus software uses signatures/hashes to detect known bad files, which relies on regular full-disk scans and hoping the vendor has already fingerprinted the malware before you encounter it. SentinelOne is different: it looks at an application’s behaviour, and if any known bad or suspicious actions are taken (such as a request to encrypt the disk, as in the case of ransomware), it can stop the application immediately and quarantine it for analysis. This has the advantage of stopping brand-new threats that have never been seen before.

Why this matters

Ransomware is on the rise, and although Macs represent a much smaller target compared to Windows, they can and do still get malware. The 2022 SonicWall Cyber Threat Report collected data to show the trend:

Performance test

Method

For the tests, I chose a popular repository with a lot of files to stress the antivirus (AV) engine. I came across this post, which compares software, and chose Kubernetes. (I initially chose compiling the Raspberry Pi kernel, but this occurs in a container, which the EDR can’t see.)

The running instructions (slightly outdated) for Mac are in this gist.

1. Install Homebrew: https://brew.sh/
2. Update bash: brew install bash
3. Install dependencies: brew install go gnu-tar
4. Download a consistent Kubernetes source: https://github.com/kubernetes/kubernetes/releases/tag/v1.24.3
5. Extract the files: tar -xzvf kubernetes-1.24.3.tar.gz
6. Change directory: cd kubernetes-1.24.3
7. Set the environment variable: KUBE_BUILD_PLATFORMS=linux/amd64
8. Run the tests:

for i in {1..10}; do make clean; /usr/bin/time -a -o kubeperf-fresh.txt make all ; done

Results

The compile was timed ten times on each setup: a fresh macOS install (no EDR), with SentinelOne, and with CrowdStrike. Times are in seconds.

Compared to the baseline, SentinelOne added about 8 seconds (~5%), while CrowdStrike added about 48 seconds (~32%).

Malware detection test

I used the Mac malware collection from Objective-See. The high-level takeaway is that both products had very similar detection rates; the main difference between them was performance (above).

The table below shows the per-sample results. Legend:

• Yes — detected
• No — missed
• Partial — partially detected (still installed)
• N/A — not applicable (couldn’t be run/installed)
• — — not recorded