Inter-Process Communication: XPC Services T1559.003

Tactic: Execution

Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections). Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.

Events covered

1 catalog event is tagged with this technique by at least one rule.

ProviderEventTitle
ESFexecProcess Execution

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (12 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
event.type4eq 4start
EventType2eq 2exec
Image2starts_with 1, wildcard 1/applications/, /applications/*, /library/application support/*, /private/tmp/*
ParentImage2eq 1, starts_with 1/sbin/launchd, /system/library/coreservices/installer.app/contents/xpcse...
parent_process_name2in 1, starts_with 1bash, com., sh, zsh
process.args2eq 2, starts_with 1-c, application.com., xpcproxy
process.code_signature.exists2eq 2false
process.code_signature.trusted2eq 2false
process_name2wildcard 2, in 1curl, nscurl, bash, osascript
process.Ext.effective_parent.executable1starts_with 1/System/Library/CoreServices/Installer.app/Contents/XPCSe...
process.Ext.effective_parent.name1eq 1xpcproxy
process.args_count1le 12

Top indicator values (34 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
41078
EventTypeeq
exec
2576
process.code_signature.existseq
false
2119
process.code_signature.trustedeq
false
2115
process_namewildcard
curl
231
process_namewildcard
nscurl
214
process_namewildcard
osascript
232
process_namewildcard
python*
269
Imagestarts_with
/applications/
13
Imagewildcard
/applications/*
12
Imagewildcard
/library/application support/*
1
Imagewildcard
/private/tmp/*
15
Imagewildcard
/tmp/*
133
Imagewildcard
/users/*/library/*
1
Imagewildcard
/users/shared/*
14
Imagewildcard
/var/tmp/*
131
Imagewildcard
/volumes/*
13
ParentImageeq
/sbin/launchd
1
ParentImagestarts_with
/system/library/coreservices/installer.app/contents/xpcservices/installerremo...
1
parent_process_namein
bash
165
parent_process_namein
sh
165
parent_process_namein
zsh
163
parent_process_namestarts_with
com.
1
process.Ext.effective_parent.executablestarts_with
/System/Library/CoreServices/Installer.app/Contents/XPCServices/InstallerRemo...
1
process.Ext.effective_parent.nameeq
xpcproxy
1
process.argseq
-c
1107
process.argseq
xpcproxy
12
process.argsstarts_with
application.com.
1
process.args_countle
2
117
process_namein
bash
1202

Exclusions (27 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CommandLinewildcard
*sh -c */Library/Application Support/HmaProVpn/hub/userinit.sh*
1
CommandLinewildcard
/bin/sh -c git-upload-pack*
1
CommandLinewildcard
sh -c /bin/cp /Library/Preferences/SystemConfiguration/preferences.plist...
1
Imagestarts_with
/applications/
1
ParentImageeq
/library/appquest/com.apple.questd
1
ParentImagewildcard
/applications/*
1
ParentImagewildcard
/library/application...
1
ParentImagewildcard
/library/application...
1
ParentImagewildcard
/library/application...
1
ParentImagewildcard
/library/application support/symantec/silo/mes/liveupdate/com.symantec.symluhelper
1
ParentImagewildcard
/library/application support/symantec/silo/nfm/liveupdate/com.symantec.symluhelper
1
ParentImagewildcard
/library/privilegedhelpertools/*
1
ParentImagewildcard
/library/systemextensions/*
1
ParentImagewildcard
/private/var/db/com.apple.xpc.*
1
ParentImagewildcard
/private/var/folders/*/*/*/apptranslocation/*
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint

Elastic 4 rules