Add MacOS.Raptorscope macOS triage artifacts (BTM, ConfigProfiles, Netstat, SignedProcesses)

[cac0ns3c]

Adds four macOS DFIR triage artifacts that fill collection gaps with no adequate first-party built-in. All pass velociraptor artifacts verify.

Artifact	Collects	Depends on
MacOS.Raptorscope.SignedProcesses	running processes enriched with code-signature trust (codesign) — stock MacOS.Sys.Pslist emits only a hash, so signature-based detections can't fire from it alone	MacOS.Sys.Pslist
MacOS.Raptorscope.BTM	Background Task Management persistence (macOS 13+) via sfltool dumpbtm — launch agents/daemons + login items	—
MacOS.Raptorscope.Netstat	live socket table (listeners + established) with the owning process	MacOS.Sys.Pslist, netstat()
MacOS.Raptorscope.ConfigProfiles	installed configuration/MDM profiles with signing status via profiles show	—

Validation

Collected and validated against a real macOS host (Velociraptor v0.77.1):

• SignedProcesses — 489 processes, each with a populated CodeSignature{Exists,Trusted,SubjectName}; correctly flags untrusted binaries.
• BTM — parses real sfltool dumpbtm output (developer, disposition→enabled, decoded path).
• Netstat — 66 connections with resolved process/executable.
• ConfigProfiles — verifies and parses a schema-accurate sample; the field mapping follows Apple's documented profiles plist schema but has not yet been confirmed against a host with profiles installed (unmanaged test host had none). Happy to hold this one for a follow-up if you'd prefer to land the other three first.

Notes

• SignedProcesses/BTM/ConfigProfiles want the client running with sufficient privilege; TCC-protected sources aren't touched here.
• Naming uses a MacOS.Raptorscope.* vendor namespace — glad to rename to functional categories (e.g. MacOS.Network.Netstat, MacOS.System.BackgroundTaskManagement) if that's preferred for the Exchange.

Source and paired ECS normalizers/Sigma detections: https://github.com/cac0ns3c/Raptorscope