SentinelLabs Logo RGB WhitePurp
ABOUT
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
sentinelone

macOS Catalina | The Big Upgrade, Don’t Get Caught Out!

macOS | 12 minute read
Read More >
sentinelone

Checkm8: 5 Key Facts About the New iOS Boot ROM Exploit

macOS | 7 minute read
Read More >
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 39

The Good, the Bad and the Ugly | 3 minute read
Read More >
Detecting MacOS.GMERA Malware Through Behavioral Inspection 1
labs
Crimeware

Detecting macOS.GMERA Malware Through Behavioral Inspection

Phil Stokes / September 25, 2019

New malware hits macOS with well-worn techniques. Can behavioral detection prevent attacks that evade legacy AV and built-in Apple security?

Read More
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 37

The Good, the Bad and the Ugly | 3 minute read
Read More >
sentinelone

What is macOS Notarization? – An Easy Guide 101

macOS | 9 minute read
Read More >
MacOS Incident Response   Part 3  System Manipulation 1
labs
Security Research

macOS Incident Response | Part 3: System Manipulation

Phil Stokes / September 4, 2019

How can you detect system manipulations by malware, local or remote attackers on macOS? Find out in the final part of our series on macOS Incident Response.

Read More
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 35

The Good, the Bad and the Ugly | 4 minute read
Read More >
MacOS Incident Response   Part 2  User Data Activity And Behavior 2
labs
Security Research

macOS Incident Response | Part 2: User Data, Activity and Behavior

Phil Stokes / August 28, 2019

What can we learn about user activity and behavior on a compromised Mac? Learn about the hidden and obfuscated data stores Apple use on the macOS platform.

Read More
MacOS Incident Response   Part 1  Collecting Device File System Data 1
labs
Security Research

macOS Incident Response | Part 1: Collecting Device, File & System Data

Phil Stokes / August 21, 2019

How should you investigate an infected Mac? Has there been lateral movement, data exfiltration, system manipulation? Learn macOS incident response here.

Read More
Previous
1 … 14 15 16 17 18 19
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails
    Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails
    January 29, 2026
  • LABScon25 Replay | How to Bug Hotel Rooms v2.0
    LABScon25 Replay | How to Bug Hotel Rooms v2.0
    January 21, 2026
  • LLMs in the SOC (Part 1) | Why Benchmarks Fail Security Operations Teams
    LLMs in the SOC (Part 1) | Why Benchmarks Fail Security Operations Teams
    January 20, 2026

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2026 SentinelOne, All Rights Reserved.