AN0948
Analytic 0948
macOS
Detects anomalous use of macOS XPC services for code execution. Monitors for processes invoking privileged XPC daemons with abnormal parameters, unexpected binaries communicating over NSXPCConnection, or helper tools executing code outside of their expected parent process lineage. Correlates process access attempts to system-level daemons, privilege escalations via XPC misconfigurations, and injection of malicious payloads through inter-process communication.
macos:unifiedlog
Unexpected NSXPCConnection calls by non-Apple-signed or abnormal binaries
macos:unifiedlog
execve: Helper tools invoked through XPC executing unexpected binaries
macos:unifiedlog
XPC messages requesting privileged actions from untrusted or unsigned clients
[AllowedXPCClients]
Maintain allowlist of binaries permitted to invoke specific XPC services to minimize false positives.
[TimeWindow]
Threshold for correlating abnormal XPC requests with subsequent privilege escalation or process creation.
[UnsignedBinaryAlertLevel]
Adjust sensitivity of alerts for unsigned or non-Apple-signed clients initiating XPC communication.