This is an old (2011) video from the Snow Leopard days showing how Audit Explorer can use Apple's BSM audit data to detect and analyze the activity of malware installed by an Advanced Persistent Threat actor.
Bob Has an APT
Todd Heberlein
Developer of the original Network Security Monitor (NSM)