Building a macOS Detection Engineering Lab — Part 2: macOS VMs on Mac Hardware

Option A: Tart (CLI-First, Perfect for Automation)

Tart is my recommendation for an easy macOS lab VM. It’s a CLI tool built on Apple’s Virtualization.framework that’s designed for automation and CI/CD workflows. Requires Apple Silicon (host macOS 13+) — it will not run on Intel Macs.

Installation

brew install cirruslabs/cli/tart

Create Your First VM

# Pull a pre-built macOS image (fastest way to start)
# Ventura still works; newer images (sonoma/sequoia/tahoe-*-base) are also on ghcr.io/cirruslabs
tart clone ghcr.io/cirruslabs/macos-ventura-base:latest ventura-lab

# Start the VM
tart run ventura-lab

# In another terminal, get the IP and SSH in
ssh admin@$(tart ip ventura-lab)
# Default credentials for Cirrus images: admin / admin

Why Tart for Detection Labs

• Scriptable — Automate VM creation, cloning, and teardown
• Fast cloning — Create fresh VMs in seconds using APFS clones
• OCI images — Share VM images via container registries
• Headless operation — Run VMs without a GUI for CI/CD
• Snapshots — Built-in snapshot support

Useful Commands

# List VMs
tart list

# Stop a VM
tart stop ventura-lab

# Clone for clean testing (instant with APFS)
tart clone ventura-lab ventura-test

# Delete a VM
tart delete ventura-test

# Create from IPSW (build your own)
# Prefer --from-ipsw=latest, or pass a real IPSW path whose version matches the VM name
tart create --from-ipsw=latest sonoma-custom
# Example with a local IPSW (14.x = Sonoma, not Ventura):
# tart create --from-ipsw ~/Downloads/UniversalMac_14.0_23A344.ipsw sonoma-custom

---

Option B: UTM (GUI, Beginner-Friendly)

UTM wraps Apple’s Virtualization.framework in a friendly GUI. Great if you prefer clicking over typing.

Installation

Download from getutm.app or:

brew install --cask utm

Create a macOS VM

1. Get a macOS IPSW (not a full installer .app):

   • Easiest: in UTM’s macOS wizard, let UTM download the latest compatible IPSW automatically (recommended)
   • Or download an IPSW from ipsw.me — treat third-party IPSW mirrors as untrusted; prefer UTM’s automatic download
   • Note: softwareupdate --fetch-full-installer downloads a full installer .app to /Applications, which is not an IPSW and is not what UTM’s Virtualize → macOS flow wants

2. Create VM in UTM:

   • Click ”+” → “Virtualize” → “macOS 12+” (wording may vary by UTM version)
   • Select your IPSW file (or accept UTM’s download)
   • Allocate resources:
     • CPU: 4+ cores
     • RAM: 8GB+ (16GB recommended)
     • Disk: 64GB+
   • Click Create and wait for boot

3. Complete macOS Setup:

   • Run through the standard macOS setup wizard
   • Create a local account

4. Enable Remote Login:

   sudo systemsetup -setremotelogin on

UTM Tips

• “Save VM State” needs newer host/guest support (Apple Virtualization save-state is limited on older macOS — expect it on macOS 14+ guests/hosts; otherwise shut down cleanly)
• Shared directories work via virtio-fs (macOS 13+ guest and host)
• Performance is near-native on Apple Silicon
• macOS guests require an Apple Silicon host

---

Post-Install Setup (All Options)

Regardless of which tool you used, configure your VM for lab work:

Enable SSH

sudo systemsetup -setremotelogin on

Disable Sleep

Keep the VM awake for long-running tests:

sudo pmset -a disablesleep 1

Install Homebrew

You’ll want this for installing tools:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

---

Next Steps

Your macOS VM is ready. In the next post, we’ll cover setting up macOS VMs on Proxmox for those running Intel servers.

If you’re sticking with Mac hardware, skip ahead to Part 4 — Collecting macOS Logs.

Next: Part 3 — macOS VMs on Proxmox →

---