Awesome talk, thanks for sharing!
I really enjoy red team talks.
The part which focused on ssh was very interesting.
2 things:
you can check if remote login is enabled with:
sudo systemsetup -getremotelogin
ssh detection:
process = ssh
commandline contains 127.0.0.1 AND -i
My recent talk on attacking macOS environments is on youtube now! ☠️