How macOS Endpoint Security Gives Security Tools Visibility Into System Activity
Summary
An overview of macOS Endpoint Security explains its event monitoring and blocking capabilities, user approvals and permissions, and how event data can help security teams investigate activity and build detections.
Key points
- Endpoint Security is available on macOS Catalina (10.15) and later and exposes selected system events to security applications.
- Applications can subscribe to event types; notification events report activity, while authorization events can allow an application to act before an operation proceeds.
- Using Endpoint Security requires an Apple-granted entitlement, and installing a system extension generally requires user approval and Full Disk Access.
- Tools such as Apple's eslogger can display event data, including executable paths and command-line arguments.
- Detection engineers can use event data with Sigma rules or NSPredicate-based logic; the article illustrates examining Shlayer command-line activity.
- Endpoint Security event streams can be noisy, so detections may need to account for routine system activity.
Article Details
- Topic
- macOS Endpoint Security (ES) architecture, event monitoring, and threat-detection use
People
Chris RossNamed in connection with Appmon, a tool for viewing Endpoint Security event data.Pepijn BruienneQuoted in the article clarifying that the feature is called Endpoint Security or ES, rather than Endpoint Security Framework or ESF.Stuart AshenbrennerAuthor of the article about macOS Endpoint Security.
Malware
Vendors
Products
Calculatorwe have an ES_EVENT_TYPE_NOTIFY_EXEC, or ‘exec event’, event that occurred when we simply open the Calculator application.Endpoint SecurityEndpoint Security In a macOS WorldFull Disk AccessNot only will the user need to approve the system extension, but they will need to allow Full Disk Access (FDA) permissions to the ES application as well. Fortunately, if this application is using a system extension,macOS CatalinaAt the Worldwide Developer Conference (WWDC) in 2019, Apple announced the release of macOS Catalina and along with it, system extensions and, something they referred to as the Endpoint Security Framework, or ESF.NSPredicateIt is possible to use rules from Sigma or writing predicates with NSPredicate that can be backed by data from ES. These can be ingested into a SIEM to capture and iterate over that data. These rules will allow you toSigmaIt is possible to use rules from Sigma or writing predicates with NSPredicate that can be backed by data from ES. These can be ingested into a SIEM to capture and iterate over that data. These rules will allow you toSystem Extensionapplications have access and visibility to their system. This means that when installing any type of system extension (which ES is typically bundled into) on your system, and whether it leverages ES or not is moot, it
Tools
AppmonThere are tools like Apple's eslogger (see below), ESFPlayground from The Mitten Mac, or Appmon by Chris Ross that can print out raw data of Endpoint Security events.ESFPlaygroundThere are tools like Apple's eslogger (see below), ESFPlayground from The Mitten Mac, or Appmon by Chris Ross that can print out raw data of Endpoint Security events.esloggerThere are tools like Apple's eslogger (see below), ESFPlayground from The Mitten Mac, or Appmon by Chris Ross that can print out raw data of Endpoint Security events.