Endpoint Security ESF
Grouped by functional domain. Kernel-level event types use Apple's own es_events_t documentation sections. Events Apple doesn't place in a documentation section are grouped below, under Catalog groupings, by their es_event_<family>_* struct family. The AUTH/NOTIFY action and the introduced-in-macOS version are the only hard axes.
Apple documentation sections File open, close, create, write, rename, clone, copy, truncate, lookup, and access operations. Reads and changes of file metadata: mode, owner, ACLs, extended attributes, flags, timestamps, and directory listings. File Provider extension materialization and update of placeholder items. Link creation, unlink, and symbolic-link resolution. Filesystem mount, unmount, and remount. Mapping a file into memory and changing page protections (writable-to-executable transitions). Process execution, fork, exit, signalling, process inspection, and chdir/chroot. Cross-process actions: suspend/resume, ptrace-style tracing, and remote thread creation. Acquisition of another process's Mach task port (control, name, read, inspect). Real and effective user- and group-ID changes (privilege transitions). Invalidation of a running process's dynamic code signature. UNIX-domain socket bind and connect. (ESF has no IP network-connection event.) System clock changes. Kernel-extension load/unload and IOKit user-client open. PTY grant and close.File System Events
File Metadata Events
File Provider Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH File Provider Materialize N N ES_ NOTIFY File Provider Materialize N N ES_ AUTH File Provider Update N N ES_ NOTIFY File Provider Update N N Symbolic Link Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH File Unlink Y N ES_ NOTIFY File Unlink Y Y ES_ AUTH Hard Link Create N N ES_ NOTIFY Hard Link Create N N ES_ AUTH Symbolic Link Read Y N ES_ NOTIFY Symbolic Link Read Y N File System Mounting Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH Filesystem Mount Y N ES_ NOTIFY Filesystem Mount Y N ES_ AUTH Filesystem Remount N N ES_ NOTIFY Filesystem Remount N N ES_ NOTIFY Filesystem Unmount Y N Memory Mapping Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH Memory Map File Y N ES_ NOTIFY Memory Map File Y N ES_ AUTH Memory Protection Change Y N ES_ NOTIFY Memory Protection Change Y N Process Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH Change Directory Y N ES_ NOTIFY Change Directory Y N ES_ AUTH Change Root Directory N N ES_ NOTIFY Change Root Directory N N ES_ AUTH Process Execution Y N ES_ NOTIFY Process Execution Y Y ES_ NOTIFY Process Exit Y N ES_ NOTIFY Process Fork Y Y ES_ AUTH Process Info Access Check Y N ES_ NOTIFY Process Info Access Check Y N ES_ AUTH Signal Delivery Y N ES_ NOTIFY Signal Delivery Y Y Interprocess Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH Process Suspend / Resume Y N ES_ NOTIFY Process Suspend / Resume Y N ES_ NOTIFY Process Tracing Attach N N ES_ NOTIFY Remote Thread Creation N N Task Port Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH Task Control Port Retrieval N N ES_ NOTIFY Task Control Port Retrieval N N ES_ NOTIFY Task Inspect Port Retrieval N N ES_ NOTIFY Task Name Port Retrieval N N ES_ AUTH Task Read Port Retrieval N N ES_ NOTIFY Task Read Port Retrieval N N User and Group ID Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Process Set Effective Group ID (setegid) N N ES_ NOTIFY Process Set Effective User ID (seteuid) N N ES_ NOTIFY Process Set Real Group ID (setgid) N N ES_ NOTIFY Process Set Real User ID (setuid) N N ES_ NOTIFY Process Set Real and Effective Group IDs (setregid) N N ES_ NOTIFY Process Set Real and Effective User IDs (setreuid) N N Code Signing Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Code Signature Invalidated N N Socket Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH UNIX Domain Socket Bind N N ES_ NOTIFY UNIX Domain Socket Bind N N ES_ AUTH UNIX Domain Socket Connect N N ES_ NOTIFY UNIX Domain Socket Connect N N Clock Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH Set System Time N N ES_ NOTIFY Set System Time N N Kernel Events
Event type AUTH/NOTIFY Title Sample Rule ES_ AUTH IOKit User Client Open N N ES_ NOTIFY IOKit User Client Opened N N ES_ AUTH Kernel Extension Load N N ES_ NOTIFY Kernel Extension Load N Y ES_ NOTIFY Kernel Extension Unload N Y PTY Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Pseudoterminal Device Closed N N ES_ NOTIFY Pseudoterminal Device Granted N N
Catalog groupings (events Apple does not document in a section) OpenSSH (sshd) login and logout, with authentication result and source address. XPC service connection requests. Local authentication attempts and the su / sudo privilege-elevation utilities. loginwindow GUI session login, logout, lock, and unlock. Screen Sharing (VNC) session attach and detach. Console login(1) authentication login and logout. Security Authorization Services right petitions and the system's judgement. Open Directory user/group creation, deletion, membership, password, and attribute changes. XProtect malware detection and remediation. Background Task Management (BTM) launch- and login-item add/remove (persistence). Configuration-profile installation and removal. User override of a Gatekeeper block to run quarantined software. Transparency, Consent & Control (TCC) privacy-permission changes.OpenSSH Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY OpenSSH Login N N ES_ NOTIFY OpenSSH Logout N N XPC Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY XPC Service Connection Y Y Authentication Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Authentication Attempt N N ES_ NOTIFY su Command Execution Y N ES_ NOTIFY sudo Command Execution N Y Login Window Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY LoginWindow Session Lock N N ES_ NOTIFY LoginWindow Session Login N N ES_ NOTIFY LoginWindow Session Logout N N ES_ NOTIFY LoginWindow Session Unlock N N Screen Sharing Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Screen Sharing Session Attached N N ES_ NOTIFY Screen Sharing Session Detached N N Login Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Login Utility Authentication Attempt N N ES_ NOTIFY Login Utility Session Logout N N Authorization Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Authorization Rights Judgement N N ES_ NOTIFY Authorization Rights Petition N N Open Directory Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY OpenDirectory Attribute Set (Replaced) N N ES_ NOTIFY OpenDirectory Attribute Value Added N N ES_ NOTIFY OpenDirectory Attribute Value Removed N N ES_ NOTIFY OpenDirectory Group Created Y N ES_ NOTIFY OpenDirectory Group Deleted Y N ES_ NOTIFY OpenDirectory Group Member Added N N ES_ NOTIFY OpenDirectory Group Member Removed N N ES_ NOTIFY OpenDirectory Group Membership Replaced N N ES_ NOTIFY OpenDirectory Password Modified N N ES_ NOTIFY OpenDirectory User Account Created Y N ES_ NOTIFY OpenDirectory User Account Deleted Y N ES_ NOTIFY OpenDirectory User Account Disabled N N ES_ NOTIFY OpenDirectory User Account Enabled N N XProtect Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY XProtect Malware Detected N N ES_ NOTIFY XProtect Malware Remediated N N Background Task Management Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Background Task Management Launch Item Added N N ES_ NOTIFY Background Task Management Launch Item Removed N N Profile Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Configuration Profile Installed N N ES_ NOTIFY Configuration Profile Removed N N Gatekeeper Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY Gatekeeper User Override N N TCC Events
Event type AUTH/NOTIFY Title Sample Rule ES_ NOTIFY TCC Privacy Permission Modified N Y
ES_EVENT_TYPE_AUTH_OPEN: File Open
#Description
Fires before the kernel grants a process access to open a file. An active ESF client must respond with allow or deny (and optionally a narrowed flag mask via es_respond_flags_result) before the kernel proceeds. The payload carries the target file and the kernel-internal fflag mask (FREAD/FWRITE, not open(2) O_* values).
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_OPEN), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_open_t struct.
{
"message": {
"action": {
"result": {
"result": {
"flags": 4294967295
},
"result_type": 1
}
},
"action_type": 1,
"event": {
"open": {
"fflag": 17825793,
"file": {
"path": "/usr/bin",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524288,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571579,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 926,
"st_rdev": 0,
"st_size": 29632,
"st_uid": 0
}
}
}
},
"event_type": 10,
"global_seq_num": 0,
"mach_time": 8835601011736,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3669176
},
"time": "2026-06-22T23:22:48.825298069Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_RENAME: File Rename
#Description
Fires before the kernel renames a file or directory. An active ESF client must respond before the kernel proceeds. The payload identifies the source file and the destination, which is either an existing file or a new path in a specified directory.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_RENAME), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_rename_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"rename": {
"destination": {
"existing_file": {
"path": "/Users/admin/Library/Application Support/Claude/Cache/Cache_Data/index-dir/the-real-index",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:22:47.008372154Z",
"st_birthtimespec": "2026-06-22T23:22:47.008372154Z",
"st_blksize": 4096,
"st_blocks": 1904,
"st_ctimespec": "2026-06-22T23:22:47.009320104Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968312,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:22:47.008775108Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 973512,
"st_uid": 501
}
}
},
"destination_type": 0,
"source": {
"path": "/Users/admin/Library/Application Support/Claude/Cache/Cache_Data/index-dir/temp-index",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:23:16.989715491Z",
"st_birthtimespec": "2026-06-22T23:23:16.989715491Z",
"st_blksize": 4096,
"st_blocks": 1904,
"st_ctimespec": "2026-06-22T23:23:16.990115279Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968359,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:23:16.990115279Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 973512,
"st_uid": 501
}
}
}
},
"event_type": 25,
"global_seq_num": 0,
"mach_time": 8836276986391,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 91252,
"pidversion": 295038,
"rgid": 20,
"ruid": 501
},
"cdhash": "8E5D94DEC6DDDB609E2CF3C41FC526AE3674BED9",
"codesigning_flags": 570495761,
"cs_validation_category": 6,
"executable": {
"path": "/Applications/Claude.app/Contents/Frameworks/Claude Helper.app/Contents/MacOS/Claude Helper",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T21:36:23.015229786Z",
"st_birthtimespec": "2026-06-18T13:11:10.000000000Z",
"st_blksize": 4096,
"st_blocks": 920,
"st_ctimespec": "2026-06-19T03:56:11.018160830Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55323983,
"st_mode": 33261,
"st_mtimespec": "2026-06-18T13:11:10.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 468432,
"st_uid": 501
}
},
"group_id": 91247,
"is_es_client": false,
"is_platform_binary": false,
"original_ppid": 91247,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 91247,
"pidversion": 295029,
"rgid": 20,
"ruid": 501
},
"ppid": 91247,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 91247,
"pidversion": 295029,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.anthropic.claudefordesktop.helper",
"start_time": "2026-06-22T21:36:20.466127Z",
"team_id": "Q6L2SF6YDW",
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3594820
},
"time": "2026-06-22T23:23:16.990656815Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_OPEN: File Open
#Description
Fires after the kernel grants a process access to open a file. The payload carries the target file and the kernel-internal fflag mask recording the access that was permitted.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_open_t struct.
{
"message": {
"action": {
"result": {
"result": {
"flags": 4294967295
},
"result_type": 1
}
},
"action_type": 1,
"event": {
"open": {
"fflag": 17825793,
"file": {
"path": "/usr/bin",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524288,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571579,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 926,
"st_rdev": 0,
"st_size": 29632,
"st_uid": 0
}
}
}
},
"event_type": 10,
"global_seq_num": 0,
"mach_time": 8835601011736,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3669176
},
"time": "2026-06-22T23:22:48.825298069Z",
"version": 10
}
}
Detection Patterns #
Collection: Archive Collected Data
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
process_name | eq | osascript | 10 rules | elastic |
process.code_signature.exists | eq | false | 9 rules | elastic |
process.code_signature.trusted | eq | false | 9 rules | elastic |
file.name | eq | cookies | 8 rules | elastic |
file.name | eq | cookies.binarycookies | 8 rules | elastic |
file.name | eq | cookies.sqlite | 8 rules | elastic |
file.name | eq | key?.db | 8 rules | elastic |
file.name | eq | login data | 8 rules | elastic |
file.name | eq | logins.json | 8 rules | elastic |
file.name | eq | login.keychain-db | 6 rules | elastic |
Image | is_not_null | | 5 rules | elastic |
TargetFilename | wildcard | /users/*/.electrum/* | 5 rules | elastic |
TargetFilename | wildcard | /users/*/library/application support/*/default/local extension settings/* | 5 rules | elastic |
TargetFilename | wildcard | /users/*/library/application support/@trezor/* | 5 rules | elastic |
TargetFilename | wildcard | /users/*/library/application support/atomic/* | 5 rules | elastic |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
T1539, T1552, T1552.001, T1555, T1555.001, T1558T1005, T1539, T1555, T1555.003T1083, T1548, T1548.006
References #
ES_EVENT_TYPE_NOTIFY_CLOSE: File Close
#Description
Fires after a process closes a file descriptor. The payload records whether the file was modified during the descriptor's lifetime and, in message version 6 and later, whether it was ever mapped writable.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_close_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"close": {
"modified": false,
"target": {
"path": "/usr/bin",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524288,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571579,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 926,
"st_rdev": 0,
"st_size": 29632,
"st_uid": 0
}
},
"was_mapped_writable": false
}
},
"event_type": 12,
"global_seq_num": 0,
"mach_time": 8835736858163,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3670278
},
"time": "2026-06-22T23:22:54.485515276Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_CREATE: File or Directory Create
#Description
Fires after a new filesystem object (file, directory, or special file) is created. The payload distinguishes whether the new object replaced an existing file or was written to a fresh path, and carries the creation mode and any ACL.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_create_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"create": {
"acl": null,
"destination": {
"existing_file": {
"path": "/private/var/folders/99/hfkwj0616gl7sllsdfzfx6b80000gn/T/TemporaryItems/ContextStoreAgent.plist.9YlpR0s",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:23:03.781301756Z",
"st_birthtimespec": "2026-06-22T23:23:03.781301756Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:23:03.781603836Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968341,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:23:03.781301756Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 0,
"st_uid": 501
}
}
},
"destination_type": 0
}
},
"event_type": 13,
"global_seq_num": 0,
"mach_time": 8835959975544,
"process": {
"audit_token": {
"asid": 100043,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 647,
"pidversion": 1569,
"rgid": 20,
"ruid": 501
},
"cdhash": "9D261051393D3F2144540E4E23E5B84169440DD2",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/sbin/cfprefsd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 32,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575955,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 135920,
"st_uid": 0
}
},
"group_id": 647,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100043,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 647,
"pidversion": 1569,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.cfprefsd",
"start_time": "2026-06-17T20:22:04.989806Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3670458
},
"time": "2026-06-22T23:23:03.781989666Z",
"version": 10
}
}
Detection Patterns #
1 rule
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
Image | ends_with | /curl | 2 rules | sigma |
TargetFilename | ends_with | .plist | 2 rules | sigma |
TargetFilename | ends_with | .pth | 1 rule | sigma |
TargetFilename | regex_match | (?i)/lib/python3\.([5-9]|[0-9]{2})/site-packages/ | 1 rule | sigma |
TargetFilename | starts_with | /users/ | 1 rule | sigma |
TargetFilename | wildcard | /*/.vscode/tasks.json | 1 rule | elastic |
TargetFilename | wildcard | ?:\*\.vscode\tasks.json | 1 rule | elastic |
process_name | in | curl | 2 rules | elastic |
process_name | in | cursor | 2 rules | elastic |
process_name | in | cursor.exe | 2 rules | elastic |
process_name | in | windsurf | 2 rules | elastic |
process_name | in | windsurf.exe | 2 rules | elastic |
EventType | eq | create | 1 rule | sigma |
file.extension | eq | dmg | 1 rule | elastic |
file.extension | in | asp | 1 rule | elastic |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1546, T1546.014T1037, T1037.005T1543, T1543.004, T1564, T1564.001
References #
ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA: Atomic Data Exchange
#Description
Fires after two files atomically swap their data forks via the exchangedata(2) syscall. The operation swaps the content of both files in place while preserving each file's metadata, making it a technique used to perform atomic file updates.
References #
ES_EVENT_TYPE_NOTIFY_RENAME: File Rename
#Description
Fires after a file or directory is renamed. The payload identifies the source file and the destination, which is either an existing file or a new path.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_rename_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"rename": {
"destination": {
"existing_file": {
"path": "/Users/admin/Library/Application Support/Claude/Cache/Cache_Data/index-dir/the-real-index",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:22:47.008372154Z",
"st_birthtimespec": "2026-06-22T23:22:47.008372154Z",
"st_blksize": 4096,
"st_blocks": 1904,
"st_ctimespec": "2026-06-22T23:22:47.009320104Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968312,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:22:47.008775108Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 973512,
"st_uid": 501
}
}
},
"destination_type": 0,
"source": {
"path": "/Users/admin/Library/Application Support/Claude/Cache/Cache_Data/index-dir/temp-index",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:23:16.989715491Z",
"st_birthtimespec": "2026-06-22T23:23:16.989715491Z",
"st_blksize": 4096,
"st_blocks": 1904,
"st_ctimespec": "2026-06-22T23:23:16.990115279Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968359,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:23:16.990115279Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 973512,
"st_uid": 501
}
}
}
},
"event_type": 25,
"global_seq_num": 0,
"mach_time": 8836276986391,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 91252,
"pidversion": 295038,
"rgid": 20,
"ruid": 501
},
"cdhash": "8E5D94DEC6DDDB609E2CF3C41FC526AE3674BED9",
"codesigning_flags": 570495761,
"cs_validation_category": 6,
"executable": {
"path": "/Applications/Claude.app/Contents/Frameworks/Claude Helper.app/Contents/MacOS/Claude Helper",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T21:36:23.015229786Z",
"st_birthtimespec": "2026-06-18T13:11:10.000000000Z",
"st_blksize": 4096,
"st_blocks": 920,
"st_ctimespec": "2026-06-19T03:56:11.018160830Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55323983,
"st_mode": 33261,
"st_mtimespec": "2026-06-18T13:11:10.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 468432,
"st_uid": 501
}
},
"group_id": 91247,
"is_es_client": false,
"is_platform_binary": false,
"original_ppid": 91247,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 91247,
"pidversion": 295029,
"rgid": 20,
"ruid": 501
},
"ppid": 91247,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 91247,
"pidversion": 295029,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.anthropic.claudefordesktop.helper",
"start_time": "2026-06-22T21:36:20.466127Z",
"team_id": "Q6L2SF6YDW",
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3594820
},
"time": "2026-06-22T23:23:16.990656815Z",
"version": 10
}
}
Detection Patterns #
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
file.Ext.header_bytes | starts_with | cafebabe | 2 rules | elastic |
file.Ext.header_bytes | starts_with | cffaedfe | 2 rules | elastic |
TargetFilename | starts_with | /private/tmp/ | 1 rule | elastic |
TargetFilename | starts_with | /tmp/ | 1 rule | elastic |
file.extension | eq | dmg | 1 rule | elastic |
file.extension | in | asp | 1 rule | elastic |
file.extension | in | aspx | 1 rule | elastic |
file.extension | in | bmp | 1 rule | elastic |
file.extension | in | cgi | 1 rule | elastic |
file.extension | in | conf | 1 rule | elastic |
file.extension | in | doc | 1 rule | elastic |
file.extension | in | docx | 1 rule | elastic |
file.extension | in | gif | 1 rule | elastic |
file.extension | in | html | 1 rule | elastic |
file.extension | in | jpeg | 1 rule | elastic |
References #
ES_EVENT_TYPE_NOTIFY_WRITE: File Write
#Description
Fires after a process writes data to a file. The payload identifies the target file. This event fires for each write operation and can be high-volume on active systems.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_write_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"write": {
"target": {
"path": "/dev/ttys000",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:23:10.313599000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:23:49.718344000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 745,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:23:49.718344000Z",
"st_nlink": 1,
"st_rdev": 268435456,
"st_size": 0,
"st_uid": 501
}
}
}
},
"event_type": 33,
"global_seq_num": 0,
"mach_time": 8837062456411,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 90398,
"pidversion": 292873,
"rgid": 20,
"ruid": 501
},
"cdhash": "CFC3F12808D14BD762D1B058535ECEB28113256E",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/bin/ssh",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1520,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312572846,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1555472,
"st_uid": 0
}
},
"group_id": 90398,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 38472,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 38472,
"pidversion": 136758,
"rgid": 20,
"ruid": 501
},
"ppid": 38472,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 965,
"pidversion": 2477,
"rgid": 20,
"ruid": 501
},
"session_id": 38471,
"signing_id": "com.apple.ssh",
"start_time": "2026-06-22T19:33:39.096397Z",
"team_id": null,
"tty": {
"path": "/dev/ttys000",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:23:10.313599000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:23:49.718344000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 745,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:23:49.718344000Z",
"st_nlink": 1,
"st_rdev": 268435456,
"st_size": 0,
"st_uid": 501
}
}
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3501634
},
"time": "2026-06-22T23:23:49.718281587Z",
"version": 10
}
}
Detection Patterns #
Show All Detection Patterns
Collection: Archive Collected Data
Collection: Archive Collected Data
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
file.Ext.header_bytes | starts_with | cafebabe | 14 rules | elastic |
file.Ext.header_bytes | starts_with | cffaedfe | 14 rules | elastic |
TargetFilename | starts_with | /private/tmp/ | 12 rules | elastic |
TargetFilename | starts_with | /tmp/ | 12 rules | elastic |
TargetFilename | starts_with | /users/shared/ | 9 rules | elastic |
TargetFilename | starts_with | /var/tmp/ | 7 rules | elastic |
TargetFilename | starts_with | /private/var/tmp/ | 6 rules | elastic |
TargetFilename | wildcard | /private/tmp/* | 5 rules | elastic |
TargetFilename | wildcard | /tmp/* | 5 rules | elastic |
TargetFilename | wildcard | /users/shared/* | 5 rules | elastic |
process_name | in | curl | 10 rules | elastic |
process_name | in | nscurl | 9 rules | elastic |
process.code_signature.exists | eq | false | 7 rules | elastic |
process.code_signature.trusted | eq | false | 7 rules | elastic |
file.extension | in | sh | 6 rules | elastic |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
T1546, T1554, T1556, T1574T1105, T1204, T1204.002T1059, T1059.002, T1059.004, T1059.006, T1059.007, T1102
References #
ES_EVENT_TYPE_AUTH_TRUNCATE: File Truncate
#Description
Fires before the kernel truncates a file, either via truncate(2) or by opening with O_TRUNC. An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_TRUNCATE), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_truncate_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"truncate": {
"target": {
"path": "/Users/admin/Library/Daemon Containers/A592654B-A0DB-4552-AB8F-D7244CC4BAD0/Data/Library/Saved Application State/768A2C1A-FB64-4686-842F-78D56F1E46FD.savedState/window_29.data",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T21:22:01.920462302Z",
"st_birthtimespec": "2026-06-22T21:22:01.920462302Z",
"st_blksize": 4096,
"st_blocks": 184,
"st_ctimespec": "2026-06-22T23:23:42.931626413Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55774432,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:23:42.931626413Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 92016,
"st_uid": 501
}
}
}
},
"event_type": 41,
"global_seq_num": 0,
"mach_time": 8836899579278,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 677,
"pidversion": 1653,
"rgid": 20,
"ruid": 501
},
"cdhash": "3D4B6EE2243C0E090963BA895DEC6AF72F52A19D",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/CoreServices/talagentd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 384,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312106201,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 508688,
"st_uid": 0
}
},
"group_id": 677,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 677,
"pidversion": 1653,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.talagent",
"start_time": "2026-06-17T20:22:05.997116Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3670994
},
"time": "2026-06-22T23:23:42.931795079Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_TRUNCATE: File Truncate
#Description
Fires after a file is truncated. The payload identifies the file that was truncated.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_truncate_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"truncate": {
"target": {
"path": "/Users/admin/Library/Daemon Containers/A592654B-A0DB-4552-AB8F-D7244CC4BAD0/Data/Library/Saved Application State/768A2C1A-FB64-4686-842F-78D56F1E46FD.savedState/window_29.data",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T21:22:01.920462302Z",
"st_birthtimespec": "2026-06-22T21:22:01.920462302Z",
"st_blksize": 4096,
"st_blocks": 184,
"st_ctimespec": "2026-06-22T23:23:42.931626413Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55774432,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:23:42.931626413Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 92016,
"st_uid": 501
}
}
}
},
"event_type": 41,
"global_seq_num": 0,
"mach_time": 8836899579278,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 677,
"pidversion": 1653,
"rgid": 20,
"ruid": 501
},
"cdhash": "3D4B6EE2243C0E090963BA895DEC6AF72F52A19D",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/CoreServices/talagentd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 384,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312106201,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 508688,
"st_uid": 0
}
},
"group_id": 677,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 677,
"pidversion": 1653,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.talagent",
"start_time": "2026-06-17T20:22:05.997116Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3670994
},
"time": "2026-06-22T23:23:42.931795079Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_LOOKUP: Path Lookup
#Description
Fires after a path component is looked up by the kernel VFS layer. This is a very high-volume event that fires for virtually every filesystem name resolution; most deployments filter heavily by process or path prefix.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_lookup_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"lookup": {
"relative_target": "usr/bin/eslogger",
"source_dir": {
"path": "/",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 1048576,
"st_gen": 0,
"st_gid": 0,
"st_ino": 2,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 22,
"st_rdev": 0,
"st_size": 704,
"st_uid": 0
}
}
}
},
"event_type": 43,
"global_seq_num": 0,
"mach_time": 8837909197546,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671143
},
"time": "2026-06-22T23:24:24.998846607Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_CREATE: File or Directory Create
#Description
Fires before the kernel creates a new filesystem object. An active ESF client must respond before the kernel proceeds. The payload describes the intended destination, mode, and any ACL for the new object.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_CREATE), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_create_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"create": {
"acl": null,
"destination": {
"existing_file": {
"path": "/private/var/folders/99/hfkwj0616gl7sllsdfzfx6b80000gn/T/TemporaryItems/ContextStoreAgent.plist.9YlpR0s",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:23:03.781301756Z",
"st_birthtimespec": "2026-06-22T23:23:03.781301756Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:23:03.781603836Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968341,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:23:03.781301756Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 0,
"st_uid": 501
}
}
},
"destination_type": 0
}
},
"event_type": 13,
"global_seq_num": 0,
"mach_time": 8835959975544,
"process": {
"audit_token": {
"asid": 100043,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 647,
"pidversion": 1569,
"rgid": 20,
"ruid": 501
},
"cdhash": "9D261051393D3F2144540E4E23E5B84169440DD2",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/sbin/cfprefsd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 32,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575955,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 135920,
"st_uid": 0
}
},
"group_id": 647,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100043,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 647,
"pidversion": 1569,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.cfprefsd",
"start_time": "2026-06-17T20:22:04.989806Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3670458
},
"time": "2026-06-22T23:23:03.781989666Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_ACCESS: Access Permission Check
#Description
Fires after a process checks file accessibility via access(2) or faccessat(2). The payload records the access mode being tested and the target file.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_access_t struct.
{
"message": {
"action": {
"result": {
"result": {
"flags": 2147483647
},
"result_type": 1
}
},
"action_type": 1,
"event": {
"access": {
"mode": 4,
"target": {
"path": "/Users/admin/Library/Application Support/Firefox/Profiles/vey0ajp8.default-release/datareporting/glean/db",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T21:44:25.016398999Z",
"st_birthtimespec": "2024-06-05T22:26:54.432534337Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:24:13.874090112Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 275197,
"st_mode": 16877,
"st_mtimespec": "2026-06-22T23:24:13.874090112Z",
"st_nlink": 3,
"st_rdev": 0,
"st_size": 96,
"st_uid": 501
}
}
}
},
"event_type": 55,
"global_seq_num": 0,
"mach_time": 8837651690873,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 20,
"euid": 501,
"pid": 382,
"pidversion": 989,
"rgid": 20,
"ruid": 501
},
"cdhash": "5847BA08A75BDA208810BDBD55C5E5F04D7CB031",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/Support/fseventsd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 312,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312153078,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 398608,
"st_uid": 0
}
},
"group_id": 382,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 382,
"pidversion": 989,
"rgid": 0,
"ruid": 0
},
"session_id": 382,
"signing_id": "com.apple.fseventsd",
"start_time": "2026-06-17T20:22:01.678559Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3587485
},
"time": "2026-06-22T23:24:14.269497783Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_CLONE: File Clone
#Description
Fires before the kernel creates a copy-on-write clone of a file via clonefile(2). An active ESF client must respond before the kernel proceeds. The payload identifies the source file, the destination directory, and the new filename.
References #
ES_EVENT_TYPE_NOTIFY_CLONE: File Clone
#Description
Fires after a copy-on-write clone of a file is created via clonefile(2). The payload identifies the source file, the destination directory, and the new filename.
References #
ES_EVENT_TYPE_NOTIFY_FCNTL: File Control Operation
#Description
Fires after a process performs a file control operation via fcntl(2). This event is particularly useful for detecting dynamic access-flag changes, such as a process upgrading a file descriptor to writable.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_fcntl_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"fcntl": {
"cmd": 50,
"target": {
"path": "/usr/bin",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524288,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571579,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 926,
"st_rdev": 0,
"st_size": 29632,
"st_uid": 0
}
}
}
},
"event_type": 62,
"global_seq_num": 0,
"mach_time": 8837468384228,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671143
},
"time": "2026-06-22T23:24:06.631789348Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_DUP: File Descriptor Duplicate
#Description
Fires after a process duplicates a file descriptor via dup(2) or dup2(2). The payload describes the file the duplicated descriptor refers to.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_dup_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"dup": {
"target": {
"path": "/Users/admin/Library/Application Support/Firefox/Profiles/vey0ajp8.default-release/extensions/uBlock0@raymondhill.net.xpi",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:22:27.990573049Z",
"st_birthtimespec": "2026-05-26T19:54:33.340689306Z",
"st_blksize": 4096,
"st_blocks": 8800,
"st_ctimespec": "2026-05-31T11:26:06.809121271Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 52208712,
"st_mode": 33188,
"st_mtimespec": "2026-05-31T11:26:06.809000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 4504632,
"st_uid": 501
}
}
}
},
"event_type": 73,
"global_seq_num": 0,
"mach_time": 8837349337902,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"cdhash": "DE8C0F5D3FBEFC963A08A83131B85E2DCBF1F221",
"codesigning_flags": 570512129,
"cs_validation_category": 6,
"executable": {
"path": "/Applications/Firefox.app/Contents/MacOS/firefox",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T21:09:47.904194145Z",
"st_birthtimespec": "2026-06-18T18:48:50.747285257Z",
"st_blksize": 4096,
"st_blocks": 344,
"st_ctimespec": "2026-06-21T18:31:01.870315311Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 80,
"st_ino": 55224420,
"st_mode": 33277,
"st_mtimespec": "2026-06-18T18:48:50.750202023Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 174432,
"st_uid": 501
}
},
"group_id": 83147,
"is_es_client": false,
"is_platform_binary": false,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "org.mozilla.firefox",
"start_time": "2026-06-21T18:31:02.071749Z",
"team_id": "43AQ936H96",
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671548
},
"time": "2026-06-22T23:24:01.671570131Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_EXCHANGEDATA: Atomic Data Exchange
#Description
Fires before the kernel allows two files to atomically swap their data forks via exchangedata(2). An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_AUTH_SEARCHFS: Filesystem Search
#Description
Fires before the kernel allows a process to search a volume for files matching attribute criteria via searchfs(2). An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_NOTIFY_SEARCHFS: Filesystem Search
#Description
Fires after a process searches a volume via searchfs(2). The payload identifies the attribute criteria and the volume that was searched.
References #
ES_EVENT_TYPE_AUTH_FCNTL: File Control Operation
#Description
Fires before the kernel processes a file control command via fcntl(2). An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_FCNTL), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_fcntl_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"fcntl": {
"cmd": 50,
"target": {
"path": "/usr/bin",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524288,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571579,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 926,
"st_rdev": 0,
"st_size": 29632,
"st_uid": 0
}
}
}
},
"event_type": 62,
"global_seq_num": 0,
"mach_time": 8837468384228,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671143
},
"time": "2026-06-22T23:24:06.631789348Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_COPYFILE: Copy File
#Description
Fires before the kernel performs a server-side file copy via the copyfile(3) library call or its underlying clonefile/fcopyfile mechanics. An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_NOTIFY_COPYFILE: Copy File
#Description
Fires after a file is copied via the copyfile(3) library call. The payload identifies the source file, the destination directory and filename, any overwritten target, and the copy flags used.
References #
ES_EVENT_TYPE_NOTIFY_SETATTRLIST: Set Attribute List
#Description
Fires after a process modifies a file's attributes via setattrlist(2). The payload names the attribute set being written and the target file.
References #
ES_EVENT_TYPE_NOTIFY_SETEXTATTR: Set Extended Attribute
#Description
Fires after a process writes an extended attribute to a file via setxattr(2). The payload identifies the target file and the name of the attribute being set.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_setextattr_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"setextattr": {
"extattr": "NSImageMetadata",
"target": {
"path": "/Users/admin/Library/Daemon Containers/A592654B-A0DB-4552-AB8F-D7244CC4BAD0/Data/Library/Saved Application State/768A2C1A-FB64-4686-842F-78D56F1E46FD.savedState/window_29.data",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T21:22:01.920462302Z",
"st_birthtimespec": "2026-06-22T21:22:01.920462302Z",
"st_blksize": 4096,
"st_blocks": 480,
"st_ctimespec": "2026-06-22T23:25:09.015631070Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55774432,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:25:09.015631070Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 242848,
"st_uid": 501
}
}
}
},
"event_type": 27,
"global_seq_num": 0,
"mach_time": 8838965614041,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 677,
"pidversion": 1653,
"rgid": 20,
"ruid": 501
},
"cdhash": "3D4B6EE2243C0E090963BA895DEC6AF72F52A19D",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/CoreServices/talagentd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 384,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312106201,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 508688,
"st_uid": 0
}
},
"group_id": 677,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 677,
"pidversion": 1653,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.talagent",
"start_time": "2026-06-17T20:22:05.997116Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671934
},
"time": "2026-06-22T23:25:09.015806902Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_SETFLAGS: Set File Flags
#Description
Fires after a process modifies the BSD flags of a file via chflags(2). The payload carries the new flag value and the target file.
References #
ES_EVENT_TYPE_NOTIFY_SETMODE: Set File Mode
#Description
Fires after a process changes the permission mode of a file via chmod(2). The payload records the new mode and the target file.
References #
ES_EVENT_TYPE_NOTIFY_SETOWNER: Set File Owner
#Description
Fires after a process changes the ownership of a file via chown(2). The payload records the new UID, new GID, and the target file.
References #
ES_EVENT_TYPE_AUTH_SETATTRLIST: Set Attribute List
#Description
Fires before the kernel allows a process to write filesystem attributes via setattrlist(2). An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_AUTH_SETEXTATTR: Set Extended Attribute
#Description
Fires before the kernel allows a process to write an extended attribute via setxattr(2). An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_SETEXTATTR), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_setextattr_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"setextattr": {
"extattr": "NSImageMetadata",
"target": {
"path": "/Users/admin/Library/Daemon Containers/A592654B-A0DB-4552-AB8F-D7244CC4BAD0/Data/Library/Saved Application State/768A2C1A-FB64-4686-842F-78D56F1E46FD.savedState/window_29.data",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T21:22:01.920462302Z",
"st_birthtimespec": "2026-06-22T21:22:01.920462302Z",
"st_blksize": 4096,
"st_blocks": 480,
"st_ctimespec": "2026-06-22T23:25:09.015631070Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55774432,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:25:09.015631070Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 242848,
"st_uid": 501
}
}
}
},
"event_type": 27,
"global_seq_num": 0,
"mach_time": 8838965614041,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 677,
"pidversion": 1653,
"rgid": 20,
"ruid": 501
},
"cdhash": "3D4B6EE2243C0E090963BA895DEC6AF72F52A19D",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/CoreServices/talagentd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 384,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312106201,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 508688,
"st_uid": 0
}
},
"group_id": 677,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 677,
"pidversion": 1653,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.talagent",
"start_time": "2026-06-17T20:22:05.997116Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671934
},
"time": "2026-06-22T23:25:09.015806902Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_SETFLAGS: Set File Flags
#Description
Fires before the kernel allows a process to change the BSD flags of a file via chflags(2). An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_AUTH_SETMODE: Set File Mode
#Description
Fires before the kernel allows a process to change file permissions via chmod(2). An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_AUTH_SETOWNER: Set File Owner
#Description
Fires before the kernel allows a process to change file ownership via chown(2). An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_AUTH_GETATTRLIST: Get Attribute List
#Description
Fires before the kernel allows a process to read filesystem attributes via getattrlist(2). An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_GETATTRLIST), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_getattrlist_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"getattrlist": {
"attrlist": {
"bitmapcount": 5,
"commonattr": 134217728,
"dirattr": 0,
"fileattr": 0,
"forkattr": 0,
"volattr": 0
},
"target": {
"path": "/usr/libexec/xpcproxy",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 128,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575884,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 233312,
"st_uid": 0
}
}
}
},
"event_type": 53,
"global_seq_num": 0,
"mach_time": 8838376351555,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94360,
"pidversion": 301349,
"rgid": 0,
"ruid": 0
},
"cdhash": "CCE5A9291F9EDF6CF64C40599E481EE7BB5E2A38",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/xpcproxy",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 128,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575884,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 233312,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94360,
"pidversion": 301349,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.proxy",
"start_time": "2026-06-22T23:24:44.448971Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3672361
},
"time": "2026-06-22T23:24:44.463422883Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_GETATTRLIST: Get Attribute List
#Description
Fires after a process reads filesystem attributes via getattrlist(2). The payload names the attributes retrieved and the target file.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_getattrlist_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"getattrlist": {
"attrlist": {
"bitmapcount": 5,
"commonattr": 134217728,
"dirattr": 0,
"fileattr": 0,
"forkattr": 0,
"volattr": 0
},
"target": {
"path": "/usr/libexec/xpcproxy",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 128,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575884,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 233312,
"st_uid": 0
}
}
}
},
"event_type": 53,
"global_seq_num": 0,
"mach_time": 8838376351555,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94360,
"pidversion": 301349,
"rgid": 0,
"ruid": 0
},
"cdhash": "CCE5A9291F9EDF6CF64C40599E481EE7BB5E2A38",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/xpcproxy",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 128,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575884,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 233312,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94360,
"pidversion": 301349,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.proxy",
"start_time": "2026-06-22T23:24:44.448971Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3672361
},
"time": "2026-06-22T23:24:44.463422883Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_STAT: File Stat
#Description
Fires after a process queries file metadata via stat(2) or related calls. Because stat is called by many system operations, this is a very high-volume event and most clients filter aggressively.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_stat_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"stat": {
"target": {
"path": "/usr/bin",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524288,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571579,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 926,
"st_rdev": 0,
"st_size": 29632,
"st_uid": 0
}
}
}
},
"event_type": 54,
"global_seq_num": 0,
"mach_time": 8837773020607,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671143
},
"time": "2026-06-22T23:24:19.324858315Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_UTIMES: File Timestamp Modify
#Description
Fires before the kernel allows a process to change the access or modification timestamps of a file via utimes(2) or related calls. An active ESF client must respond before the kernel proceeds. Timestamp manipulation is a common anti-forensics technique.
References #
ES_EVENT_TYPE_NOTIFY_UTIMES: File Timestamp Modify
#Description
Fires after the access or modification timestamps of a file are changed via utimes(2) or related calls. Timestamp modification is a common anti-forensics technique used to disguise recently dropped files.
References #
ES_EVENT_TYPE_AUTH_GETEXTATTR: Get Extended Attribute
#Description
Fires before the kernel allows a process to read an extended attribute via getxattr(2). An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_GETEXTATTR), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_getextattr_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"getextattr": {
"extattr": "com.apple.root.installed",
"target": {
"path": "/System/Library/CoreServices/WiFiAgent.app/Contents/MacOS/WiFiAgent",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 448,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312105215,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 655936,
"st_uid": 0
}
}
}
},
"event_type": 64,
"global_seq_num": 0,
"mach_time": 8857245546038,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 466,
"pidversion": 1086,
"rgid": 0,
"ruid": 0
},
"cdhash": "45457D1E1F4205D62747F50DAC3986124EC293D7",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/airportd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 2592,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312574697,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 3220640,
"st_uid": 0
}
},
"group_id": 466,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 466,
"pidversion": 1086,
"rgid": 0,
"ruid": 0
},
"session_id": 466,
"signing_id": "com.apple.airport.airportd",
"start_time": "2026-06-17T20:22:02.435512Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3687766
},
"time": "2026-06-22T23:37:49.969399850Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_GETEXTATTR: Get Extended Attribute
#Description
Fires after a process reads an extended attribute via getxattr(2). The payload names the attribute retrieved and the target file.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_getextattr_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"getextattr": {
"extattr": "com.apple.root.installed",
"target": {
"path": "/System/Library/CoreServices/WiFiAgent.app/Contents/MacOS/WiFiAgent",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 448,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312105215,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 655936,
"st_uid": 0
}
}
}
},
"event_type": 64,
"global_seq_num": 0,
"mach_time": 8857245546038,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 466,
"pidversion": 1086,
"rgid": 0,
"ruid": 0
},
"cdhash": "45457D1E1F4205D62747F50DAC3986124EC293D7",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/airportd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 2592,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312574697,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 3220640,
"st_uid": 0
}
},
"group_id": 466,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 466,
"pidversion": 1086,
"rgid": 0,
"ruid": 0
},
"session_id": 466,
"signing_id": "com.apple.airport.airportd",
"start_time": "2026-06-17T20:22:02.435512Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3687766
},
"time": "2026-06-22T23:37:49.969399850Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_LISTEXTATTR: List Extended Attributes
#Description
Fires before the kernel allows a process to enumerate the extended attributes of a file via listxattr(2). An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_LISTEXTATTR), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_listextattr_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"listextattr": {
"target": {
"path": "/Users/admin/Library/Containers/com.apple.news.tag/Data/SystemData/com.apple.chrono/timelines/topic/systemLarge---1341790371802874391----344.00w-344.00h-27.88r-kwXjBcg0jLGkOXgfIR#vfsEQ3NEuHIIxpQplS#DfabA=.chrono-timeline",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:25:27.793989526Z",
"st_birthtimespec": "2026-06-22T23:25:27.148107512Z",
"st_blksize": 4096,
"st_blocks": 712,
"st_ctimespec": "2026-06-22T23:25:27.804667681Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968612,
"st_mode": 33206,
"st_mtimespec": "2026-06-22T23:25:27.791825712Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 364360,
"st_uid": 501
}
}
}
},
"event_type": 66,
"global_seq_num": 0,
"mach_time": 8839416570567,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 721,
"pidversion": 1804,
"rgid": 20,
"ruid": 501
},
"cdhash": "D66138B95614DDD3F43D02F3BF2B8F8A976846ED",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/PrivateFrameworks/ChronoCore.framework/Support/chronod",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312266803,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 160992,
"st_uid": 0
}
},
"group_id": 721,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 721,
"pidversion": 1804,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.chronod",
"start_time": "2026-06-17T20:22:06.330454Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671806
},
"time": "2026-06-22T23:25:27.805494132Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_LISTEXTATTR: List Extended Attributes
#Description
Fires after a process enumerates the extended attribute names of a file via listxattr(2).
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_listextattr_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"listextattr": {
"target": {
"path": "/Users/admin/Library/Containers/com.apple.news.tag/Data/SystemData/com.apple.chrono/timelines/topic/systemLarge---1341790371802874391----344.00w-344.00h-27.88r-kwXjBcg0jLGkOXgfIR#vfsEQ3NEuHIIxpQplS#DfabA=.chrono-timeline",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:25:27.793989526Z",
"st_birthtimespec": "2026-06-22T23:25:27.148107512Z",
"st_blksize": 4096,
"st_blocks": 712,
"st_ctimespec": "2026-06-22T23:25:27.804667681Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968612,
"st_mode": 33206,
"st_mtimespec": "2026-06-22T23:25:27.791825712Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 364360,
"st_uid": 501
}
}
}
},
"event_type": 66,
"global_seq_num": 0,
"mach_time": 8839416570567,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 721,
"pidversion": 1804,
"rgid": 20,
"ruid": 501
},
"cdhash": "D66138B95614DDD3F43D02F3BF2B8F8A976846ED",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/PrivateFrameworks/ChronoCore.framework/Support/chronod",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312266803,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 160992,
"st_uid": 0
}
},
"group_id": 721,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 721,
"pidversion": 1804,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.chronod",
"start_time": "2026-06-17T20:22:06.330454Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671806
},
"time": "2026-06-22T23:25:27.805494132Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_READDIR: Read Directory
#Description
Fires before the kernel allows a process to read a directory's entries. An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_READDIR), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_readdir_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"readdir": {
"target": {
"path": "/usr/bin",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524288,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571579,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 926,
"st_rdev": 0,
"st_size": 29632,
"st_uid": 0
}
}
}
},
"event_type": 68,
"global_seq_num": 0,
"mach_time": 8838045020495,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671870
},
"time": "2026-06-22T23:24:30.658085613Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_READDIR: Read Directory
#Description
Fires after a process reads directory entries. The payload identifies the directory that was enumerated.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_readdir_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"readdir": {
"target": {
"path": "/usr/bin",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524288,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571579,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 926,
"st_rdev": 0,
"st_size": 29632,
"st_uid": 0
}
}
}
},
"event_type": 68,
"global_seq_num": 0,
"mach_time": 8838045020495,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3671870
},
"time": "2026-06-22T23:24:30.658085613Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_DELETEEXTATTR: Delete Extended Attribute
#Description
Fires before the kernel allows a process to remove an extended attribute via removexattr(2). An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR: Delete Extended Attribute
#Description
Fires after a process removes an extended attribute from a file via removexattr(2). The payload identifies the attribute that was removed and the target file.
References #
ES_EVENT_TYPE_AUTH_FSGETPATH: Filesystem Path Retrieve
#Description
Fires before the kernel allows a process to resolve the filesystem path of an object by inode number or file descriptor via fsgetpath(3). An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_FSGETPATH), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_fsgetpath_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"fsgetpath": {
"target": {
"path": "/usr/lib/dyld",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1768,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312573277,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 2374000,
"st_uid": 0
}
}
}
},
"event_type": 72,
"global_seq_num": 0,
"mach_time": 8838186457671,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 94353,
"pidversion": 301336,
"rgid": 20,
"ruid": 501
},
"cdhash": "160AC44B1460AC5D214FE99209F7115AAC343870",
"codesigning_flags": 570495761,
"cs_validation_category": 6,
"executable": {
"path": "/Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:24:02.663764839Z",
"st_birthtimespec": "2026-06-18T18:48:46.181229028Z",
"st_blksize": 4096,
"st_blocks": 232,
"st_ctimespec": "2026-06-21T18:31:01.870714059Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 80,
"st_ino": 55224233,
"st_mode": 33277,
"st_mtimespec": "2026-06-18T18:48:50.506541645Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 118656,
"st_uid": 501
}
},
"group_id": 83147,
"is_es_client": false,
"is_platform_binary": false,
"original_ppid": 83147,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"ppid": 83147,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "org.mozilla.plugincontainer",
"start_time": "2026-06-22T23:24:36.550687Z",
"team_id": "43AQ936H96",
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3672222
},
"time": "2026-06-22T23:24:36.551248569Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_FSGETPATH: Filesystem Path Retrieve
#Description
Fires after a process resolves the filesystem path of an object via fsgetpath(3). The payload identifies the object whose path was retrieved.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_fsgetpath_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"fsgetpath": {
"target": {
"path": "/usr/lib/dyld",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1768,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312573277,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 2374000,
"st_uid": 0
}
}
}
},
"event_type": 72,
"global_seq_num": 0,
"mach_time": 8838186457671,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 94353,
"pidversion": 301336,
"rgid": 20,
"ruid": 501
},
"cdhash": "160AC44B1460AC5D214FE99209F7115AAC343870",
"codesigning_flags": 570495761,
"cs_validation_category": 6,
"executable": {
"path": "/Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:24:02.663764839Z",
"st_birthtimespec": "2026-06-18T18:48:46.181229028Z",
"st_blksize": 4096,
"st_blocks": 232,
"st_ctimespec": "2026-06-21T18:31:01.870714059Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 80,
"st_ino": 55224233,
"st_mode": 33277,
"st_mtimespec": "2026-06-18T18:48:50.506541645Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 118656,
"st_uid": 501
}
},
"group_id": 83147,
"is_es_client": false,
"is_platform_binary": false,
"original_ppid": 83147,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"ppid": 83147,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "org.mozilla.plugincontainer",
"start_time": "2026-06-22T23:24:36.550687Z",
"team_id": "43AQ936H96",
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3672222
},
"time": "2026-06-22T23:24:36.551248569Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_SETACL: Set File ACL
#Description
Fires before the kernel allows a process to set or clear the Access Control List on a file. An active ESF client must respond before the kernel proceeds. ACL modification can be used to grant or revoke access to sensitive files.
References #
ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE: File Provider Materialize
#Description
Fires before a FileProvider extension downloads and places a cloud-backed (evicted) file onto local storage. An active ESF client must respond before the kernel proceeds. The payload identifies the staged source and the local destination.
References #
ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE: File Provider Materialize
#Description
Fires after a FileProvider extension places a cloud-backed file on local storage. The payload identifies the staged source and the local destination where the file now resides.
References #
ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE: File Provider Update
#Description
Fires before a FileProvider extension updates the local copy of a cloud-backed file. An active ESF client must respond before the kernel proceeds. The payload identifies the staged source and the destination path.
References #
ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE: File Provider Update
#Description
Fires after a FileProvider extension updates the local copy of a cloud-backed file. The payload identifies the staged source and the local path to which it was moved.
References #
ES_EVENT_TYPE_AUTH_UNLINK: File Unlink
#Description
Fires before the kernel removes a file's directory entry. An active ESF client must respond before the kernel proceeds. The payload identifies the target file and the directory that contains it.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_UNLINK), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_unlink_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"unlink": {
"parent_dir": {
"path": "/Users/admin/Library/Biome/tmp",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T13:45:52.510341701Z",
"st_birthtimespec": "2024-06-18T05:34:41.441027928Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:23:12.676799775Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 420563,
"st_mode": 16877,
"st_mtimespec": "2026-06-22T23:23:12.676799775Z",
"st_nlink": 4,
"st_rdev": 0,
"st_size": 128,
"st_uid": 501
}
},
"target": {
"path": "/Users/admin/Library/Biome/tmp/.tmp.fvWu6acU",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:23:12.676792816Z",
"st_birthtimespec": "2026-06-22T23:23:12.676792816Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:23:12.676792816Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968347,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:23:12.676792816Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 0,
"st_uid": 501
}
}
}
},
"event_type": 32,
"global_seq_num": 1,
"mach_time": 8836173454811,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 662,
"pidversion": 1610,
"rgid": 20,
"ruid": 501
},
"cdhash": "9451A9652A07F204DB51ED84649612650A3613E7",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/PrivateFrameworks/BiomeStreams.framework/Support/BiomeAgent",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312263000,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 176320,
"st_uid": 0
}
},
"group_id": 662,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 662,
"pidversion": 1610,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.BiomeAgent",
"start_time": "2026-06-17T20:22:05.540323Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 1,
"thread": {
"thread_id": 3670689
},
"time": "2026-06-22T23:23:12.676879607Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_LINK: Hard Link Create
#Description
Fires after a new hard link to an existing file is created. The payload identifies the source file and the directory and filename of the new link.
References #
ES_EVENT_TYPE_NOTIFY_UNLINK: File Unlink
#Description
Fires after a file's directory entry is removed. The payload identifies the removed file and the directory that contained it.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_unlink_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"unlink": {
"parent_dir": {
"path": "/Users/admin/Library/Biome/tmp",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T13:45:52.510341701Z",
"st_birthtimespec": "2024-06-18T05:34:41.441027928Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:23:12.676799775Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 420563,
"st_mode": 16877,
"st_mtimespec": "2026-06-22T23:23:12.676799775Z",
"st_nlink": 4,
"st_rdev": 0,
"st_size": 128,
"st_uid": 501
}
},
"target": {
"path": "/Users/admin/Library/Biome/tmp/.tmp.fvWu6acU",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:23:12.676792816Z",
"st_birthtimespec": "2026-06-22T23:23:12.676792816Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:23:12.676792816Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 55968347,
"st_mode": 33152,
"st_mtimespec": "2026-06-22T23:23:12.676792816Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 0,
"st_uid": 501
}
}
}
},
"event_type": 32,
"global_seq_num": 1,
"mach_time": 8836173454811,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 662,
"pidversion": 1610,
"rgid": 20,
"ruid": 501
},
"cdhash": "9451A9652A07F204DB51ED84649612650A3613E7",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/PrivateFrameworks/BiomeStreams.framework/Support/BiomeAgent",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312263000,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 176320,
"st_uid": 0
}
},
"group_id": 662,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 662,
"pidversion": 1610,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.BiomeAgent",
"start_time": "2026-06-17T20:22:05.540323Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 1,
"thread": {
"thread_id": 3670689
},
"time": "2026-06-22T23:23:12.676879607Z",
"version": 10
}
}
Detection Patterns #
Execution And Immediate
Collection: Archive Collected Data
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
process_name | starts_with | python | 3 rules | elastic |
event0.process.command_line | contains | file.path | 2 rules | elastic |
event0.process.command_line | contains | file.name | 1 rule | elastic |
process.args_count | eq | 2 | 2 rules | elastic |
EventType | eq | load | 1 rule | elastic |
Image | wildcard | /applications/* | 1 rule | elastic |
Image | wildcard | /private/tmp/* | 1 rule | elastic |
Image | wildcard | /tmp/* | 1 rule | elastic |
Image | wildcard | /users/*/public/* | 1 rule | elastic |
Image | wildcard | /users/shared/* | 1 rule | elastic |
Image | wildcard | /volumes/* | 1 rule | elastic |
ImageLoaded | starts_with | /users/ | 1 rule | elastic |
TargetFilename | starts_with | /private/tmp/ | 1 rule | elastic |
TargetFilename | starts_with | /tmp/ | 1 rule | elastic |
TargetFilename | starts_with | /var/tmp/ | 1 rule | elastic |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
References #
ES_EVENT_TYPE_AUTH_READLINK: Symbolic Link Read
#Description
Fires before the kernel resolves a symbolic link, including path lookups that traverse a symlink, not only explicit readlink(2) calls. An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_READLINK), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_readlink_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"readlink": {
"source": {
"path": "/etc",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 557056,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571453,
"st_mode": 41453,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 11,
"st_uid": 0
}
}
}
},
"event_type": 39,
"global_seq_num": 0,
"mach_time": 8838798335149,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 383,
"pidversion": 1036,
"rgid": 0,
"ruid": 0
},
"cdhash": "0346AF4D0187B9FAD1FCB82CE74248416C953A33",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 8688,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312331519,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 10397072,
"st_uid": 0
}
},
"group_id": 383,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 383,
"pidversion": 1036,
"rgid": 0,
"ruid": 0
},
"session_id": 383,
"signing_id": "com.apple.mediaremoted",
"start_time": "2026-06-17T20:22:01.678803Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3672178
},
"time": "2026-06-22T23:25:02.045915327Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_READLINK: Symbolic Link Read
#Description
Fires after the kernel resolves a symbolic link. This event covers any path lookup that traverses a symlink, not only explicit readlink(2) calls, so volume can be high on busy systems.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_readlink_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"readlink": {
"source": {
"path": "/etc",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 557056,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571453,
"st_mode": 41453,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 11,
"st_uid": 0
}
}
}
},
"event_type": 39,
"global_seq_num": 0,
"mach_time": 8838798335149,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 383,
"pidversion": 1036,
"rgid": 0,
"ruid": 0
},
"cdhash": "0346AF4D0187B9FAD1FCB82CE74248416C953A33",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 8688,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312331519,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 10397072,
"st_uid": 0
}
},
"group_id": 383,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 383,
"pidversion": 1036,
"rgid": 0,
"ruid": 0
},
"session_id": 383,
"signing_id": "com.apple.mediaremoted",
"start_time": "2026-06-17T20:22:01.678803Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3672178
},
"time": "2026-06-22T23:25:02.045915327Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_LINK: Hard Link Create
#Description
Fires before the kernel creates a new hard link to an existing file. An active ESF client must respond before the kernel proceeds. The payload identifies the source file and the target directory and filename.
References #
ES_EVENT_TYPE_AUTH_MOUNT: Filesystem Mount
#Description
Fires before the kernel allows a filesystem to be mounted. An active ESF client must respond before the kernel proceeds. The payload contains the statfs structure for the filesystem being mounted.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_MOUNT), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_mount_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"mount": {
"disposition": 3,
"statfs": {
"f_bavail": 1178,
"f_bfree": 1178,
"f_blocks": 1270,
"f_bsize": 4096,
"f_ffree": 47120,
"f_files": 47120,
"f_flags": 77632024,
"f_flags_ext": 0,
"f_fsid": [
16777239,
26
],
"f_fssubtype": 0,
"f_fstypename": "apfs",
"f_iosize": 1048576,
"f_mntfromname": "/dev/disk5s1",
"f_mntonname": "/Volumes/DWM",
"f_owner": 0,
"f_type": 26
}
}
},
"event_type": 22,
"global_seq_num": 0,
"mach_time": 8840980752572,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94566,
"pidversion": 301743,
"rgid": 0,
"ruid": 0
},
"cdhash": "033D8813676B5B0FCC450F44C0190C61DC3E499A",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/Filesystems/apfs.fs/Contents/Resources/mount_apfs",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312141477,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 140048,
"st_uid": 0
}
},
"group_id": 410,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 94565,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94565,
"pidversion": 301741,
"rgid": 0,
"ruid": 0
},
"ppid": 94565,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 410,
"pidversion": 997,
"rgid": 0,
"ruid": 0
},
"session_id": 410,
"signing_id": "com.apple.mount_apfs",
"start_time": "2026-06-22T23:26:32.255503Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3674014
},
"time": "2026-06-22T23:26:32.275733421Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_MOUNT: Filesystem Mount
#Description
Fires after a filesystem is successfully mounted. The payload contains the statfs structure for the mounted filesystem, and in message version 8 and later, a disposition flag for the device.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_mount_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"mount": {
"disposition": 3,
"statfs": {
"f_bavail": 1178,
"f_bfree": 1178,
"f_blocks": 1270,
"f_bsize": 4096,
"f_ffree": 47120,
"f_files": 47120,
"f_flags": 77632024,
"f_flags_ext": 0,
"f_fsid": [
16777239,
26
],
"f_fssubtype": 0,
"f_fstypename": "apfs",
"f_iosize": 1048576,
"f_mntfromname": "/dev/disk5s1",
"f_mntonname": "/Volumes/DWM",
"f_owner": 0,
"f_type": 26
}
}
},
"event_type": 22,
"global_seq_num": 0,
"mach_time": 8840980752572,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94566,
"pidversion": 301743,
"rgid": 0,
"ruid": 0
},
"cdhash": "033D8813676B5B0FCC450F44C0190C61DC3E499A",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/Filesystems/apfs.fs/Contents/Resources/mount_apfs",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312141477,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 140048,
"st_uid": 0
}
},
"group_id": 410,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 94565,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94565,
"pidversion": 301741,
"rgid": 0,
"ruid": 0
},
"ppid": 94565,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 410,
"pidversion": 997,
"rgid": 0,
"ruid": 0
},
"session_id": 410,
"signing_id": "com.apple.mount_apfs",
"start_time": "2026-06-22T23:26:32.255503Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3674014
},
"time": "2026-06-22T23:26:32.275733421Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_UNMOUNT: Filesystem Unmount
#Description
Fires after a filesystem is unmounted. The payload contains the statfs structure describing the filesystem that was detached.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_unmount_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"unmount": {
"statfs": {
"f_bavail": 1176,
"f_bfree": 1176,
"f_blocks": 1270,
"f_bsize": 4096,
"f_ffree": 47040,
"f_files": 47042,
"f_flags": 77632024,
"f_flags_ext": 0,
"f_fsid": [
16777239,
26
],
"f_fssubtype": 1,
"f_fstypename": "apfs",
"f_iosize": 2097152,
"f_mntfromname": "/dev/disk5s1",
"f_mntonname": "/Volumes/DWU",
"f_owner": 0,
"f_type": 26
}
}
},
"event_type": 23,
"global_seq_num": 0,
"mach_time": 8841191003152,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 410,
"pidversion": 997,
"rgid": 0,
"ruid": 0
},
"cdhash": "4EB168D4A4FF05762D84BF9988F5949E63D62ED8",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/diskarbitrationd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 400,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575092,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 496080,
"st_uid": 0
}
},
"group_id": 410,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 410,
"pidversion": 997,
"rgid": 0,
"ruid": 0
},
"session_id": 410,
"signing_id": "com.apple.diskarbitrationd",
"start_time": "2026-06-17T20:22:01.684772Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3674330
},
"time": "2026-06-22T23:26:41.036095486Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_REMOUNT: Filesystem Remount
#Description
Fires before the kernel allows a filesystem to be remounted with changed options (for example, upgrading from read-only to read-write). An active ESF client must respond before the kernel proceeds.
References #
ES_EVENT_TYPE_NOTIFY_REMOUNT: Filesystem Remount
#Description
Fires after a filesystem is remounted with changed options. Remounting a read-only filesystem as read-write is a classic persistence or privilege-escalation step.
References #
ES_EVENT_TYPE_AUTH_MMAP: Memory Map File
#Description
Fires before the kernel maps a file into a process's address space and requires an active ESF client to respond before the mmap(2) call completes. The payload identifies the file being mapped and the requested memory protection flags, enabling detection of attempts to create executable or writable memory-mapped regions.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_MMAP), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_mmap_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"mmap": {
"file_pos": 0,
"flags": 262145,
"max_protection": 1,
"protection": 1,
"source": {
"path": "/Users/admin/Library/Biome/streams/restricted/App.Intent/local/799521575748394",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:36:59.432460306Z",
"st_birthtimespec": "2026-05-03T17:19:35.748925253Z",
"st_blksize": 4096,
"st_blocks": 2048,
"st_ctimespec": "2026-06-22T23:32:00.944504500Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 49502158,
"st_mode": 33152,
"st_mtimespec": "2026-05-03T17:19:35.749242251Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1048576,
"st_uid": 501
}
}
}
},
"event_type": 20,
"global_seq_num": 0,
"mach_time": 8856032652556,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 827,
"pidversion": 2091,
"rgid": 20,
"ruid": 501
},
"cdhash": "2C8D40BF9E4A968649770AA591E953D497415693",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/duetexpertd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575125,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 176016,
"st_uid": 0
}
},
"group_id": 827,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 827,
"pidversion": 2091,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.duetexpertd",
"start_time": "2026-06-17T20:22:07.969631Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3686812
},
"time": "2026-06-22T23:36:59.432623388Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_MPROTECT: Memory Protection Change
#Description
Fires before the kernel applies a mprotect(2) call and requires an active ESF client to respond before the protection change takes effect. The payload carries the desired protection flags, base address, and region size, which allows detection of pages being made executable after being written (a common shellcode staging pattern).
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_MPROTECT), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_mprotect_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"mprotect": {
"address": 4858068992,
"protection": 3,
"size": 16384
}
},
"event_type": 21,
"global_seq_num": 0,
"mach_time": 8835485357972,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92909,
"pidversion": 298530,
"rgid": 20,
"ruid": 501
},
"cdhash": "160AC44B1460AC5D214FE99209F7115AAC343870",
"codesigning_flags": 570495761,
"cs_validation_category": 6,
"executable": {
"path": "/Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:22:28.730755763Z",
"st_birthtimespec": "2026-06-18T18:48:46.181229028Z",
"st_blksize": 4096,
"st_blocks": 232,
"st_ctimespec": "2026-06-21T18:31:01.870714059Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 80,
"st_ino": 55224233,
"st_mode": 33277,
"st_mtimespec": "2026-06-18T18:48:50.506541645Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 118656,
"st_uid": 501
}
},
"group_id": 83147,
"is_es_client": false,
"is_platform_binary": false,
"original_ppid": 83147,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"ppid": 83147,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "org.mozilla.plugincontainer",
"start_time": "2026-06-22T23:03:23.065175Z",
"team_id": "43AQ936H96",
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3654551
},
"time": "2026-06-22T23:22:44.006434380Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_MMAP: Memory Map File
#Description
Fires after a file is successfully mapped into a process's address space via mmap(2). The payload is identical to the AUTH variant and carries the source file, protection flags, and mapping attributes, which are useful for identifying dylib loading and executable memory creation.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_mmap_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"mmap": {
"file_pos": 0,
"flags": 262145,
"max_protection": 1,
"protection": 1,
"source": {
"path": "/Users/admin/Library/Biome/streams/restricted/App.Intent/local/799521575748394",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:36:59.432460306Z",
"st_birthtimespec": "2026-05-03T17:19:35.748925253Z",
"st_blksize": 4096,
"st_blocks": 2048,
"st_ctimespec": "2026-06-22T23:32:00.944504500Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 20,
"st_ino": 49502158,
"st_mode": 33152,
"st_mtimespec": "2026-05-03T17:19:35.749242251Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1048576,
"st_uid": 501
}
}
}
},
"event_type": 20,
"global_seq_num": 0,
"mach_time": 8856032652556,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 827,
"pidversion": 2091,
"rgid": 20,
"ruid": 501
},
"cdhash": "2C8D40BF9E4A968649770AA591E953D497415693",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/duetexpertd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575125,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 176016,
"st_uid": 0
}
},
"group_id": 827,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 827,
"pidversion": 2091,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "com.apple.duetexpertd",
"start_time": "2026-06-17T20:22:07.969631Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3686812
},
"time": "2026-06-22T23:36:59.432623388Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_MPROTECT: Memory Protection Change
#Description
Fires after mprotect(2) changes the protection on a memory region. The payload is identical to the AUTH variant and carries the new protection value, base address, and region size, useful for detecting shellcode staging where a written region is subsequently made executable.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_mprotect_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"mprotect": {
"address": 4858068992,
"protection": 3,
"size": 16384
}
},
"event_type": 21,
"global_seq_num": 0,
"mach_time": 8835485357972,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92909,
"pidversion": 298530,
"rgid": 20,
"ruid": 501
},
"cdhash": "160AC44B1460AC5D214FE99209F7115AAC343870",
"codesigning_flags": 570495761,
"cs_validation_category": 6,
"executable": {
"path": "/Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:22:28.730755763Z",
"st_birthtimespec": "2026-06-18T18:48:46.181229028Z",
"st_blksize": 4096,
"st_blocks": 232,
"st_ctimespec": "2026-06-21T18:31:01.870714059Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 80,
"st_ino": 55224233,
"st_mode": 33277,
"st_mtimespec": "2026-06-18T18:48:50.506541645Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 118656,
"st_uid": 501
}
},
"group_id": 83147,
"is_es_client": false,
"is_platform_binary": false,
"original_ppid": 83147,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"ppid": 83147,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 83147,
"pidversion": 271876,
"rgid": 20,
"ruid": 501
},
"session_id": 1,
"signing_id": "org.mozilla.plugincontainer",
"start_time": "2026-06-22T23:03:23.065175Z",
"team_id": "43AQ936H96",
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3654551
},
"time": "2026-06-22T23:22:44.006434380Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_EXEC: Process Execution
#Description
Fires before the kernel commits an execve(2) or posix_spawn(2) call and allows an active ESF client to allow or deny the execution before it proceeds. The payload carries the fully-resolved target process, its arguments and environment, the interpreter script (if any), the working directory, and code-signing metadata.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_EXEC), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_exec_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"exec": {
"args": [
"xpcproxy",
"com.apple.WorkflowKit.BackgroundShortcutRunner.D9274865-BE5E-4A84-B081-772EF7335057",
"827"
],
"cwd": {
"path": "/",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 1048576,
"st_gen": 0,
"st_gid": 0,
"st_ino": 2,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 22,
"st_rdev": 0,
"st_size": 704,
"st_uid": 0
}
},
"dyld_exec_path": "/usr/libexec/xpcproxy",
"env": [
"XPC_FLAGS=0x100"
],
"fds": [
{
"fd": 0,
"fdtype": 1
},
{
"fd": 1,
"fdtype": 1
},
{
"fd": 2,
"fdtype": 1
}
],
"image_cpusubtype": -2147483646,
"image_cputype": 16777228,
"last_fd": 2,
"script": null,
"target": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94047,
"pidversion": 300768,
"rgid": 0,
"ruid": 0
},
"cdhash": "CCE5A9291F9EDF6CF64C40599E481EE7BB5E2A38",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/xpcproxy",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 128,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575884,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 233312,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94047,
"pidversion": 300768,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.proxy",
"start_time": "2026-06-22T23:21:32.842747Z",
"team_id": null,
"tty": null
}
}
},
"event_type": 9,
"global_seq_num": 0,
"mach_time": 8833777452940,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94047,
"pidversion": 300767,
"rgid": 0,
"ruid": 0
},
"cdhash": "D0795D8BCA8F0892188E582BC30A4361228FED4F",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/sbin/launchd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1096,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571497,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1239616,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94047,
"pidversion": 300767,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.launchd",
"start_time": "2026-06-22T23:21:32.842747Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3668926
},
"time": "2026-06-22T23:21:32.844361216Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_SIGNAL: Signal Delivery
#Description
Fires before a signal is delivered to a process and requires an active ESF client to respond before the kernel sends it. The payload identifies the signal number and the target process, enabling a client to block signals such as SIGKILL used in process-termination attacks.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_SIGNAL), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_signal_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"signal": {
"instigator": null,
"sig": 28,
"target": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 92127,
"pidversion": 296965,
"rgid": 0,
"ruid": 0
},
"cdhash": "3109741DA6031130F46B8481F48B2E877DE291CC",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/bin/su",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 48,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312572873,
"st_mode": 35309,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 121904,
"st_uid": 0
}
},
"group_id": 92127,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 92126,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 92126,
"pidversion": 296963,
"rgid": 0,
"ruid": 501
},
"ppid": 92126,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 92126,
"signing_id": "com.apple.su",
"start_time": "2026-06-22T22:35:16.129389Z",
"team_id": null,
"tty": {
"path": "/dev/ttys004",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:36:04.975739000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:36:49.937900000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 905,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:36:49.937900000Z",
"st_nlink": 1,
"st_rdev": 268435460,
"st_size": 0,
"st_uid": 0
}
}
}
}
},
"event_type": 31,
"global_seq_num": 0,
"mach_time": 8855821773392,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 92125,
"pidversion": 296962,
"rgid": 0,
"ruid": 501
},
"cdhash": "38D069EDFD9BB51CCD15082DBD35F870A3885D20",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/bin/sudo",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1472,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312572875,
"st_mode": 35145,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1580368,
"st_uid": 0
}
},
"group_id": 92125,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 92093,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92093,
"pidversion": 296900,
"rgid": 20,
"ruid": 501
},
"ppid": 92093,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 92092,
"signing_id": "com.apple.sudo",
"start_time": "2026-06-22T22:35:16.091839Z",
"team_id": null,
"tty": {
"path": "/dev/ttys003",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:36:04.989333000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:36:49.937920000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 901,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:36:49.937920000Z",
"st_nlink": 1,
"st_rdev": 268435459,
"st_size": 0,
"st_uid": 501
}
}
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3637822
},
"time": "2026-06-22T23:36:50.646070224Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_EXEC: Process Execution
#Description
Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process. The payload is identical to the AUTH variant and carries the target process, arguments, environment, interpreter script, working directory, and code-signing metadata.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_exec_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"exec": {
"args": [
"xpcproxy",
"com.apple.WorkflowKit.BackgroundShortcutRunner.D9274865-BE5E-4A84-B081-772EF7335057",
"827"
],
"cwd": {
"path": "/",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 1048576,
"st_gen": 0,
"st_gid": 0,
"st_ino": 2,
"st_mode": 16877,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 22,
"st_rdev": 0,
"st_size": 704,
"st_uid": 0
}
},
"dyld_exec_path": "/usr/libexec/xpcproxy",
"env": [
"XPC_FLAGS=0x100"
],
"fds": [
{
"fd": 0,
"fdtype": 1
},
{
"fd": 1,
"fdtype": 1
},
{
"fd": 2,
"fdtype": 1
}
],
"image_cpusubtype": -2147483646,
"image_cputype": 16777228,
"last_fd": 2,
"script": null,
"target": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94047,
"pidversion": 300768,
"rgid": 0,
"ruid": 0
},
"cdhash": "CCE5A9291F9EDF6CF64C40599E481EE7BB5E2A38",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/xpcproxy",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 128,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575884,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 233312,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94047,
"pidversion": 300768,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.proxy",
"start_time": "2026-06-22T23:21:32.842747Z",
"team_id": null,
"tty": null
}
}
},
"event_type": 9,
"global_seq_num": 0,
"mach_time": 8833777452940,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94047,
"pidversion": 300767,
"rgid": 0,
"ruid": 0
},
"cdhash": "D0795D8BCA8F0892188E582BC30A4361228FED4F",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/sbin/launchd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1096,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571497,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1239616,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94047,
"pidversion": 300767,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.launchd",
"start_time": "2026-06-22T23:21:32.842747Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3668926
},
"time": "2026-06-22T23:21:32.844361216Z",
"version": 10
}
}
Detection Patterns #
Execution And Immediate
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
process_name | eq | osascript | 24 rules | elastic |
process_name | in | bash | 47 rules | elastic |
process_name | in | sh | 47 rules | elastic |
process_name | in | zsh | 46 rules | elastic |
process_name | in | curl | 37 rules | elastic |
process_name | in | nscurl | 33 rules | elastic |
process_name | in | dash | 28 rules | elastic |
process_name | in | fish | 25 rules | elastic |
process_name | in | csh | 24 rules | elastic |
process_name | in | ksh | 24 rules | elastic |
process.args | eq | -c | 38 rules | elastic |
parent_process_name | in | bash | 26 rules | elastic |
parent_process_name | in | sh | 26 rules | elastic |
parent_process_name | in | zsh | 25 rules | elastic |
process.code_signature.trusted | eq | false | 24 rules | elastic |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1059, T1059.002T1027T1027, T1027.001Elastic #
T1071, T1071.001, T1105T1090, T1572T1027, T1027.013, T1074, T1074.001
References #
ES_EVENT_TYPE_NOTIFY_FORK: Process Fork
#Description
Fires after fork(2) or vfork(2) creates a child process. The payload carries the child es_process_t, which includes the new PID and inherited code-signing context. This event is notify-only and does not support caching.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_fork_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"fork": {
"child": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94059,
"pidversion": 300790,
"rgid": 0,
"ruid": 0
},
"cdhash": "D0795D8BCA8F0892188E582BC30A4361228FED4F",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/sbin/launchd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1096,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571497,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1239616,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 94059,
"pidversion": 300790,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.launchd",
"start_time": "2026-06-22T23:21:42.414524Z",
"team_id": null,
"tty": null
}
}
},
"event_type": 11,
"global_seq_num": 0,
"mach_time": 8834007140912,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"cdhash": "D0795D8BCA8F0892188E582BC30A4361228FED4F",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/sbin/launchd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1096,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312571497,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1239616,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 0,
"parent_audit_token": {
"asid": 0,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 0,
"pidversion": 0,
"rgid": 0,
"ruid": 0
},
"ppid": 0,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.launchd",
"start_time": "2026-06-17T20:19:43.602844Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3669186
},
"time": "2026-06-22T23:21:42.414607824Z",
"version": 10
}
}
Detection Patterns #
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
process.args_count | eq | 2 | 3 rules | elastic |
process_name | eq | chmod | 2 rules | elastic |
process_name | in | curl | 3 rules | elastic |
process_name | in | nscurl | 3 rules | elastic |
process_name | in | bash | 2 rules | elastic |
process_name | in | sh | 2 rules | elastic |
parent_process_name | wildcard | bash | 2 rules | elastic |
parent_process_name | wildcard | sh | 2 rules | elastic |
parent_process_name | wildcard | tclsh* | 2 rules | elastic |
parent_process_name | wildcard | zsh | 2 rules | elastic |
process.args | eq | -c | 2 rules | elastic |
process.args | starts_with | /Users/ | 2 rules | elastic |
process.args | wildcard | /Users/*/Applications/* | 2 rules | elastic |
process.code_signature.exists | eq | false | 2 rules | elastic |
process.code_signature.trusted | eq | false | 2 rules | elastic |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
T1059, T1059.006
References #
ES_EVENT_TYPE_NOTIFY_EXIT: Process Exit
#Description
Fires after a process terminates. The payload carries the exit status in the same format as wait(2), allowing subscribers to distinguish clean exits, signal-induced terminations, and abnormal terminations. This event is notify-only and does not support caching.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_exit_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"exit": {
"stat": 19968
}
},
"event_type": 15,
"global_seq_num": 13,
"mach_time": 8854990725493,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 95196,
"pidversion": 302953,
"rgid": 0,
"ruid": 0
},
"cdhash": "CCE5A9291F9EDF6CF64C40599E481EE7BB5E2A38",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/xpcproxy",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 128,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575884,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 233312,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 95196,
"pidversion": 302953,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.proxy",
"start_time": "2026-06-22T23:36:15.999883Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 13,
"thread": {
"thread_id": 3686432
},
"time": "2026-06-22T23:36:16.019384006Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_SIGNAL: Signal Delivery
#Description
Fires after a signal is delivered to a process. The payload carries the signal number and the target process, providing a post-fact record of inter-process signalling that can reveal process-tampering or kill-chain activity.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_signal_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"signal": {
"instigator": null,
"sig": 28,
"target": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 92127,
"pidversion": 296965,
"rgid": 0,
"ruid": 0
},
"cdhash": "3109741DA6031130F46B8481F48B2E877DE291CC",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/bin/su",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 48,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312572873,
"st_mode": 35309,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 121904,
"st_uid": 0
}
},
"group_id": 92127,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 92126,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 92126,
"pidversion": 296963,
"rgid": 0,
"ruid": 501
},
"ppid": 92126,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 92126,
"signing_id": "com.apple.su",
"start_time": "2026-06-22T22:35:16.129389Z",
"team_id": null,
"tty": {
"path": "/dev/ttys004",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:36:04.975739000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:36:49.937900000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 905,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:36:49.937900000Z",
"st_nlink": 1,
"st_rdev": 268435460,
"st_size": 0,
"st_uid": 0
}
}
}
}
},
"event_type": 31,
"global_seq_num": 0,
"mach_time": 8855821773392,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 92125,
"pidversion": 296962,
"rgid": 0,
"ruid": 501
},
"cdhash": "38D069EDFD9BB51CCD15082DBD35F870A3885D20",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/bin/sudo",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1472,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312572875,
"st_mode": 35145,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 1580368,
"st_uid": 0
}
},
"group_id": 92125,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 92093,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92093,
"pidversion": 296900,
"rgid": 20,
"ruid": 501
},
"ppid": 92093,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 92092,
"signing_id": "com.apple.sudo",
"start_time": "2026-06-22T22:35:16.091839Z",
"team_id": null,
"tty": {
"path": "/dev/ttys003",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:36:04.989333000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:36:49.937920000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 901,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:36:49.937920000Z",
"st_nlink": 1,
"st_rdev": 268435459,
"st_size": 0,
"st_uid": 501
}
}
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3637822
},
"time": "2026-06-22T23:36:50.646070224Z",
"version": 10
}
}
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
EventType | eq | signal | 3 rules | sigma |
esf.event_type | eq | 27 | 3 rules | sigma |
SignalNumber | eq | 9 | 2 rules | sigma |
Image | ends_with | /curl | 1 rule | sigma |
Image | ends_with | /wget | 1 rule | sigma |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1489T1059T1562, T1562.001
References #
ES_EVENT_TYPE_AUTH_PROC_CHECK: Process Info Access Check
#Description
Fires before a process retrieves information about another process via proc_info(2) or related calls, and requires an active ESF client to respond before the kernel proceeds. The payload identifies the target process and the specific call type and flavor, enabling policy enforcement on process enumeration.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_PROC_CHECK), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_proc_check_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"proc_check": {
"flavor": 2,
"target": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"type": 8
}
},
"event_type": 86,
"global_seq_num": 0,
"mach_time": 8834785148317,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3669176
},
"time": "2026-06-22T23:22:14.831293042Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_PROC_CHECK: Process Info Access Check
#Description
Fires after a process info access check completes. The payload is identical to the AUTH variant and carries the target process, call type, and flavor, providing a post-fact record of process enumeration or interrogation activity.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_proc_check_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"proc_check": {
"flavor": 2,
"target": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"type": 8
}
},
"event_type": 86,
"global_seq_num": 0,
"mach_time": 8834785148317,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"cdhash": "FA63DE333AA28550138FB1ADAA1178B79503E032",
"codesigning_flags": 637631233,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/endpointsecurityd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 168,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575149,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 264384,
"st_uid": 0
}
},
"group_id": 391,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 391,
"pidversion": 1021,
"rgid": 0,
"ruid": 0
},
"session_id": 391,
"signing_id": "com.apple.endpointsecurityd",
"start_time": "2026-06-17T20:22:01.680633Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3669176
},
"time": "2026-06-22T23:22:14.831293042Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_CHDIR: Change Directory
#Description
Fires before the kernel allows a process to change its working directory via chdir(2) or fchdir(2). An active ESF client must respond before the kernel proceeds.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_CHDIR), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_chdir_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"chdir": {
"target": {
"path": "/System/Volumes/Data/.Spotlight-V100/Store-V2/AC773A71-1C76-4BD0-B095-18E94FEA572A",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T19:42:42.683554174Z",
"st_birthtimespec": "2026-05-12T02:23:32.825214800Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:13:39.475851120Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 308,
"st_ino": 50519419,
"st_mode": 16888,
"st_mtimespec": "2026-06-22T23:13:39.475851120Z",
"st_nlink": 572,
"st_rdev": 0,
"st_size": 18304,
"st_uid": 0
}
}
}
},
"event_type": 51,
"global_seq_num": 0,
"mach_time": 8838569374357,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 308,
"euid": 308,
"pid": 619,
"pidversion": 1496,
"rgid": 308,
"ruid": 308
},
"cdhash": "5C2FC71535C9CED26F9E312FA5AC0C119840E1DE",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds_stores",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 648,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312153710,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 837488,
"st_uid": 0
}
},
"group_id": 619,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 308,
"euid": 308,
"pid": 619,
"pidversion": 1496,
"rgid": 308,
"ruid": 308
},
"session_id": 619,
"signing_id": "com.apple.mds_stores",
"start_time": "2026-06-17T20:22:03.847334Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3672437
},
"time": "2026-06-22T23:24:52.505967739Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_CHDIR: Change Directory
#Description
Fires after a process successfully changes its working directory. The payload identifies the new working directory.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_chdir_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"chdir": {
"target": {
"path": "/System/Volumes/Data/.Spotlight-V100/Store-V2/AC773A71-1C76-4BD0-B095-18E94FEA572A",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T19:42:42.683554174Z",
"st_birthtimespec": "2026-05-12T02:23:32.825214800Z",
"st_blksize": 4096,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:13:39.475851120Z",
"st_dev": 16777232,
"st_flags": 0,
"st_gen": 0,
"st_gid": 308,
"st_ino": 50519419,
"st_mode": 16888,
"st_mtimespec": "2026-06-22T23:13:39.475851120Z",
"st_nlink": 572,
"st_rdev": 0,
"st_size": 18304,
"st_uid": 0
}
}
}
},
"event_type": 51,
"global_seq_num": 0,
"mach_time": 8838569374357,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 308,
"euid": 308,
"pid": 619,
"pidversion": 1496,
"rgid": 308,
"ruid": 308
},
"cdhash": "5C2FC71535C9CED26F9E312FA5AC0C119840E1DE",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds_stores",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 648,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312153710,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 837488,
"st_uid": 0
}
},
"group_id": 619,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 308,
"euid": 308,
"pid": 619,
"pidversion": 1496,
"rgid": 308,
"ruid": 308
},
"session_id": 619,
"signing_id": "com.apple.mds_stores",
"start_time": "2026-06-17T20:22:03.847334Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3672437
},
"time": "2026-06-22T23:24:52.505967739Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_AUTH_CHROOT: Change Root Directory
#Description
Fires before the kernel allows a process to change its root directory via chroot(2). An active ESF client must respond before the kernel proceeds. Attackers use chroot escapes to break out of jailed environments.
References #
ES_EVENT_TYPE_NOTIFY_CHROOT: Change Root Directory
#Description
Fires after a process changes its root directory via chroot(2). The payload identifies the directory that became the new root.
References #
ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME: Process Suspend / Resume
#Description
Fires before pid_suspend(3), pid_resume(3), or pid_shutdown_sockets(3) is applied to a target process and requires an active ESF client to respond before the kernel proceeds. Blocking these calls can prevent attackers from suspending security tooling or shutting down network connections of targeted processes.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. Because eslogger records only NOTIFY messages, this AUTH event shows the payload of its NOTIFY sibling (ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME), which carries the same struct. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_proc_suspend_resume_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"proc_suspend_resume": {
"target": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 863,
"pidversion": 2226,
"rgid": 20,
"ruid": 501
},
"cdhash": "E9D05C9400F1B8879E57B640B614CE918EF2627C",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/CoreServices/Batteries.app/Contents/PlugIns/BatteriesAvocadoWidgetExtension.appex/Contents/MacOS/BatteriesAvocadoWidgetExtension",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 80,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312080087,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 178496,
"st_uid": 0
}
},
"group_id": 863,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 863,
"pidversion": 2226,
"rgid": 20,
"ruid": 501
},
"session_id": 863,
"signing_id": "com.apple.Batteries.BatteriesAvocadoWidgetExtension",
"start_time": "2026-06-17T20:22:08.952396Z",
"team_id": null,
"tty": null
},
"type": 1
}
},
"event_type": 93,
"global_seq_num": 0,
"mach_time": 8855770055153,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 465,
"pidversion": 1077,
"rgid": 0,
"ruid": 0
},
"cdhash": "BB1B177A5814927F34A8239ABE35A03E395CE26C",
"codesigning_flags": 2785106705,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/runningboardd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 32,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575590,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 139952,
"st_uid": 0
}
},
"group_id": 465,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 465,
"pidversion": 1077,
"rgid": 0,
"ruid": 0
},
"session_id": 465,
"signing_id": "com.apple.runningboardd",
"start_time": "2026-06-17T20:22:02.418356Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3686804
},
"time": "2026-06-22T23:36:48.491162831Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME: Process Suspend / Resume
#Description
Fires after pid_suspend(3), pid_resume(3), or pid_shutdown_sockets(3) completes on a target process. The payload is identical to the AUTH variant and records which process was affected and which operation was called.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_proc_suspend_resume_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"proc_suspend_resume": {
"target": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 863,
"pidversion": 2226,
"rgid": 20,
"ruid": 501
},
"cdhash": "E9D05C9400F1B8879E57B640B614CE918EF2627C",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/System/Library/CoreServices/Batteries.app/Contents/PlugIns/BatteriesAvocadoWidgetExtension.appex/Contents/MacOS/BatteriesAvocadoWidgetExtension",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 80,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312080087,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 178496,
"st_uid": 0
}
},
"group_id": 863,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 863,
"pidversion": 2226,
"rgid": 20,
"ruid": 501
},
"session_id": 863,
"signing_id": "com.apple.Batteries.BatteriesAvocadoWidgetExtension",
"start_time": "2026-06-17T20:22:08.952396Z",
"team_id": null,
"tty": null
},
"type": 1
}
},
"event_type": 93,
"global_seq_num": 0,
"mach_time": 8855770055153,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 465,
"pidversion": 1077,
"rgid": 0,
"ruid": 0
},
"cdhash": "BB1B177A5814927F34A8239ABE35A03E395CE26C",
"codesigning_flags": 2785106705,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/runningboardd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 32,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575590,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 139952,
"st_uid": 0
}
},
"group_id": 465,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 465,
"pidversion": 1077,
"rgid": 0,
"ruid": 0
},
"session_id": 465,
"signing_id": "com.apple.runningboardd",
"start_time": "2026-06-17T20:22:02.418356Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3686804
},
"time": "2026-06-22T23:36:48.491162831Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_TRACE: Process Tracing Attach
#Description
Fires when a process requests to attach to another process via ptrace(2) or a similar tracing mechanism. The payload identifies the process that will be traced. This event may fire multiple times for a single trace attempt and does not support caching.
References #
ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE: Remote Thread Creation
#Description
Fires when a process creates a thread inside another process's task via thread_create(2) or thread_create_running(2). The payload identifies the target process and, when the thread starts immediately, the initial thread state. This event does not support caching.
References #
ES_EVENT_TYPE_NOTIFY_GET_TASK: Task Control Port Retrieval
#Description
Fires after a process obtains another process's Mach task control port, typically via task_for_pid(2) or a host-special-port lookup. The task control port grants full read/write access to the target process's address space, making this event a key indicator of process injection. This event is notify-only.
References #
ES_EVENT_TYPE_AUTH_GET_TASK: Task Control Port Retrieval
#Description
Fires before a process obtains another process's Mach task control port and requires an active ESF client to respond before the kernel grants access. A task control port gives the requesting process full read/write capability over the target's address space, making this a critical gate for blocking process injection.
References #
ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME: Task Name Port Retrieval
#Description
Fires after a process obtains another process's Mach task name port. The task name port allows the holder to query the target's port namespace and basic task information without granting write access, and its retrieval can indicate reconnaissance activity.
References #
ES_EVENT_TYPE_AUTH_GET_TASK_READ: Task Read Port Retrieval
#Description
Fires before a process obtains another process's Mach task read port and requires an active ESF client to respond before the kernel grants access. The task read port allows read-only inspection of the target's address space, and blocking it prevents memory-scraping attacks.
References #
ES_EVENT_TYPE_NOTIFY_GET_TASK_READ: Task Read Port Retrieval
#Description
Fires after a process obtains another process's Mach task read port. The payload is identical to the AUTH variant and records the target process and acquisition method, providing a post-fact record of read-only process memory access.
References #
ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT: Task Inspect Port Retrieval
#Description
Fires after a process obtains another process's Mach task inspect port. The inspect port grants read-only, non-privileged introspection of a task and cannot be used to modify memory, making it lower-risk than the control or read ports but still a signal of process enumeration.
References #
ES_EVENT_TYPE_NOTIFY_SETUID: Process Set Real User ID (setuid)
#Description
Fires after a process calls setuid(2) to change its real user ID. The event carries the uid argument passed to the syscall. This is a notify-only event and does not support caching.
References #
ES_EVENT_TYPE_NOTIFY_SETGID: Process Set Real Group ID (setgid)
#Description
Fires after a process calls setgid(2) to change its real group ID. The event carries the gid argument passed to the syscall. This is a notify-only event and does not support caching.
References #
ES_EVENT_TYPE_NOTIFY_SETEUID: Process Set Effective User ID (seteuid)
#Description
Fires after a process calls seteuid(2) to change its effective user ID. The event carries the euid argument passed to the syscall. This is a notify-only event and does not support caching.
References #
ES_EVENT_TYPE_NOTIFY_SETEGID: Process Set Effective Group ID (setegid)
#Description
Fires after a process calls setegid(2) to change its effective group ID. The event carries the egid argument passed to the syscall. This is a notify-only event and does not support caching.
References #
ES_EVENT_TYPE_NOTIFY_SETREUID: Process Set Real and Effective User IDs (setreuid)
#Description
Fires after a process calls setreuid(2), which atomically sets both the real and effective user IDs. The event carries both the ruid and euid arguments. This is a notify-only event and does not support caching.
References #
ES_EVENT_TYPE_NOTIFY_SETREGID: Process Set Real and Effective Group IDs (setregid)
#Description
Fires after a process calls setregid(2), which atomically sets both the real and effective group IDs. The event carries both the rgid and egid arguments. This is a notify-only event and does not support caching.
References #
ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED: Code Signature Invalidated
#Description
Fires when the CS_VALID flag is cleared from a process, which happens when the first invalid page is paged in for a process with an otherwise valid code signature or when a process is explicitly invalidated via the csops(CS_OPS_MARKINVALID) syscall. This event does not fire if CS_HARD was set, because CS_HARD prevents the process from going invalid. The struct carries no payload fields beyond the standard message context.
References #
ES_EVENT_TYPE_NOTIFY_UIPC_BIND: UNIX Domain Socket Bind
#Description
Fires after a process binds a UNIX-domain socket to a filesystem path, creating the socket file. The payload identifies the target directory, the socket filename, and the file-creation mode.
References #
ES_EVENT_TYPE_AUTH_UIPC_BIND: UNIX Domain Socket Bind
#Description
Fires before a process binds a UNIX-domain socket to a filesystem path, giving an active ESF client the opportunity to allow or deny the operation before the kernel creates the socket file. The payload carries the same directory, filename, and mode fields as the NOTIFY variant.
References #
ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT: UNIX Domain Socket Connect
#Description
Fires after a process connects to a UNIX-domain socket. The payload identifies the socket file being connected to along with the socket's communications domain, type, and protocol.
References #
ES_EVENT_TYPE_AUTH_UIPC_CONNECT: UNIX Domain Socket Connect
#Description
Fires before a process connects to a UNIX-domain socket, allowing an active ESF client to allow or deny the connection before the kernel proceeds. The payload carries the socket file, domain, type, and protocol fields identical to the NOTIFY variant.
References #
ES_EVENT_TYPE_AUTH_SETTIME: Set System Time
#Description
Fires before the kernel allows a process to modify the system clock. An active ESF client must respond before the kernel proceeds. This event is not emitted for processes holding the com.apple.private.settime entitlement.
References #
ES_EVENT_TYPE_NOTIFY_SETTIME: Set System Time
#Description
Fires after a process modifies the system clock. This event is not emitted for processes holding the com.apple.private.settime entitlement. System time changes can be used to manipulate log timestamps.
References #
ES_EVENT_TYPE_AUTH_KEXTLOAD: Kernel Extension Load
#Description
Fires before the kernel loads a kernel extension (kext), giving an active ESF client the opportunity to allow or deny the operation before the kernel proceeds. The event carries the signing identifier of the kext being loaded. Because kexts run in kernel space, this authorization point is a critical control surface for preventing unsigned or malicious kernel modules from loading.
References #
ES_EVENT_TYPE_NOTIFY_KEXTLOAD: Kernel Extension Load
#Description
Fires after the kernel successfully loads a kernel extension. The event carries the signing identifier of the loaded kext. Subscribers receive this notification after the load has completed and cannot block the operation.
Detection Patterns #
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
EventType | eq | kextload | 3 rules | sigma |
esf.event_type | eq | 17 | 3 rules | sigma |
References #
ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD: Kernel Extension Unload
#Description
Fires after a kernel extension is successfully unloaded from the kernel. The event carries the signing identifier of the kext that was removed. Monitoring this event alongside kextload provides a complete lifecycle view of kernel module presence.
Detection Patterns #
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
EventType | eq | kextload | 3 rules | sigma |
esf.event_type | eq | 17 | 3 rules | sigma |
References #
ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN: IOKit User Client Opened
#Description
Fires after a process calls IOServiceOpen() to open a communications channel with an I/O Kit driver. The event carries the user client class name and connection type but does not expose the underlying physical device name or vendor.
References #
ES_EVENT_TYPE_AUTH_IOKIT_OPEN: IOKit User Client Open
#Description
Fires before a process opens a communications channel with an I/O Kit driver via IOServiceOpen(). An active ESF client must respond with ES_AUTH_RESULT_ALLOW or ES_AUTH_RESULT_DENY before the kernel proceeds; denying blocks the channel from opening and is the primary mechanism for preventing unauthorized hardware access (for example, blocking keylogger drivers).
References #
ES_EVENT_TYPE_NOTIFY_PTY_GRANT: Pseudoterminal Device Granted
#Description
Fires when the kernel grants a pseudoterminal (PTY) control device to a process, which occurs at the start of every local terminal session, SSH connection, or remote shell spawned by post-exploitation tooling. The event carries the device number of the granted PTY master device.
References #
ES_EVENT_TYPE_NOTIFY_PTY_CLOSE: Pseudoterminal Device Closed
#Description
Fires when a pseudoterminal control device is closed, marking the end of a terminal session or remote shell. Pairing this event with the corresponding PTY_GRANT event via the device number lets a client track the full lifetime of each PTY session.
References #
ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN: OpenSSH Login
#Description
Fires when an SSH connection is authenticated via OpenSSH, reporting whether the login succeeded and the reason if it did not. A single SSH connection that hosts multiple sessions emits only one event. This event does not support caching and cannot be used for authorization.
References #
ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT: OpenSSH Logout
#Description
Fires when an SSH session terminates via OpenSSH, reporting the user and source address of the connection that ended. This event does not support caching and cannot be used for authorization.
References #
ES_EVENT_TYPE_NOTIFY_XPC_CONNECT: XPC Service Connection
#Description
Fires when a process establishes a connection to a named XPC service, reporting the service name and the domain type in which that service resides. This event generates high volume and does not support caching.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_xpc_connect_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"xpc_connect": {
"service_domain_type": 1,
"service_name": "com.apple.system.opendirectoryd.libinfo"
}
},
"event_type": 145,
"global_seq_num": 0,
"mach_time": 8860281854848,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 95793,
"pidversion": 304080,
"rgid": 0,
"ruid": 0
},
"cdhash": "CCE5A9291F9EDF6CF64C40599E481EE7BB5E2A38",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/xpcproxy",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 128,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575884,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 233312,
"st_uid": 0
}
},
"group_id": 1,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 95793,
"pidversion": 304080,
"rgid": 0,
"ruid": 0
},
"session_id": 1,
"signing_id": "com.apple.xpc.proxy",
"start_time": "2026-06-22T23:39:54.308117Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3689432
},
"time": "2026-06-22T23:39:54.320888339Z",
"version": 10
}
}
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
EventType | eq | xpc_connect | 3 rules | sigma |
esf.event_type | eq | 65 | 3 rules | sigma |
Image | starts_with | /dev/shm/ | 1 rule | sigma |
Image | starts_with | /private/tmp/ | 1 rule | sigma |
Image | starts_with | /tmp/ | 1 rule | sigma |
Image | starts_with | /users/shared/ | 1 rule | sigma |
Image | starts_with | /var/tmp/ | 1 rule | sigma |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1559T1559T1068
References #
ES_EVENT_TYPE_NOTIFY_AUTHENTICATION: Authentication Attempt
#Description
Fires when an authentication attempt is made via OpenDirectory, TouchID, token, or Auto Unlock (Apple Watch). The event records whether the attempt succeeded and carries type-specific data in a union describing the authenticating party and credentials used.
References #
ES_EVENT_TYPE_NOTIFY_SU: su Command Execution
#Description
Fires when the su(1) command makes a policy decision. The event records the outcome, the initiating user and their UID, the target username and optional UID on success, and the shell and arguments that su would invoke. Because su is a user-space binary, an attacker could substitute a different binary to evade this event.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_su_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"su": {
"argc": 3,
"argv": [
"zsh",
"-c",
"true"
],
"env": [
"SHELL=/bin/zsh",
"COLORTERM=truecolor",
"SUDO_GID=0",
"HVPOST=0.6",
"SSH_AUTH_SOCK=/var/run/com.apple.launchd.9d7dSGoiJl/Listeners",
"SUDO_COMMAND=./run_capture.sh",
"SUDO_USER=admin",
"PRE=5",
"SUDO_TTY=/dev/ttys004",
"PWD=/Users/admin/Claude Code/macos_validation",
"LOGNAME=root",
"_=/usr/bin/su",
"SUDO_HOME=/var/root",
"HOME=/Users/admin",
"LANG=en_US.UTF-8",
"TERM=xterm-256color",
"USER=admin",
"POST=2",
"SHLVL=2",
"PATH=/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/Applications/VMware Fusion.app/Contents/Public:/Users/admin/.local/bin:/Users/admin/.cache/lm-studio/bin:/Applications/010 Editor.app/Contents/CmdLine:/Users/admin/.local/bin",
"SUDO_UID=0",
"MAIL=/var/mail/root",
"__CF_USER_TEXT_ENCODING=0x0:0:0"
],
"env_count": 23,
"failure_message": null,
"from_uid": 0,
"from_username": "root",
"shell": "/bin/zsh",
"success": true,
"to_uid": 501,
"to_username": "admin"
}
},
"event_type": 128,
"global_seq_num": 0,
"mach_time": 8844244256372,
"process": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 94798,
"pidversion": 302183,
"rgid": 20,
"ruid": 501
},
"cdhash": "3109741DA6031130F46B8481F48B2E877DE291CC",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/bin/su",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 48,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312572873,
"st_mode": 35309,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 121904,
"st_uid": 0
}
},
"group_id": 94798,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 94797,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 0,
"pid": 94797,
"pidversion": 302182,
"rgid": 0,
"ruid": 0
},
"ppid": 94797,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 94036,
"signing_id": "com.apple.su",
"start_time": "2026-06-22T23:28:48.250668Z",
"team_id": null,
"tty": {
"path": "/dev/ttys005",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:21:30.000000000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:28:43.168698000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 1053,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:28:43.168698000Z",
"st_nlink": 1,
"st_rdev": 268435461,
"st_size": 0,
"st_uid": 0
}
}
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3676186
},
"time": "2026-06-22T23:28:48.253842202Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_SUDO: sudo Command Execution
#Description
Fires when sudo(8) makes a policy decision to allow or deny privilege elevation. The event records the outcome, optional rejection information on failure, the initiating user, the target user context, and the command to be executed. Because sudo is a user-space binary, an attacker could substitute it to evade this event.
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
CommandLine | contains | sudo | 1 rule | sigma |
message | contains | tty= | 1 rule | sigma |
subsystem | eq | com.apple.sudo | 1 rule | sigma |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
References #
ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN: LoginWindow Session Login
#Description
Fires when the LoginWindow daemon logs a user into a graphical session. The event carries the short username and a graphical session identifier that correlates subsequent session events.
References #
ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT: LoginWindow Session Logout
#Description
Fires when the LoginWindow daemon logs a user out of a graphical session. The event carries the short username and the graphical session identifier matching the corresponding login event.
References #
ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK: LoginWindow Session Lock
#Description
Fires when the LoginWindow daemon locks a graphical session (screen lock). The event carries the short username and graphical session identifier for the session being locked.
References #
ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK: LoginWindow Session Unlock
#Description
Fires when the LoginWindow daemon unlocks a graphical session. The event carries the short username and graphical session identifier for the session being unlocked.
References #
ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH: Screen Sharing Session Attached
#Description
Fires when the screensharingd daemon attaches a remote viewer to a graphical session. The event records whether the attach succeeded, the source address and type, the authentication method and username, and whether a user session was already active on the target.
References #
ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH: Screen Sharing Session Detached
#Description
Fires when the screensharingd daemon terminates a remote viewer connection. The event records the source address, optional Apple ID of the viewer, and the graphical session identifier matching the earlier attach event.
References #
ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN: Login Utility Authentication Attempt
#Description
Fires when /usr/bin/login completes an authentication attempt. The event records whether the login succeeded, a failure message on failure, the username, and the UID of the user on success.
References #
ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT: Login Utility Session Logout
#Description
Fires when /usr/bin/login logs a user out. The event carries the username and UID of the user whose session ended.
References #
ES_EVENT_TYPE_NOTIFY_OD_GROUP_ADD: OpenDirectory Group Member Added
#Description
Fires after a member is added to an OpenDirectory group. The event identifies the instigating process, the group receiving the new member, the member identity, the OD node, and the result code of the operation.
References #
ES_EVENT_TYPE_NOTIFY_OD_GROUP_REMOVE: OpenDirectory Group Member Removed
#Description
Fires after a member is removed from an OpenDirectory group. The event identifies the instigating process, the affected group, the removed member's identity, the OD node, and the result code.
References #
ES_EVENT_TYPE_NOTIFY_OD_GROUP_SET: OpenDirectory Group Membership Replaced
#Description
Fires after the full membership list of an OpenDirectory group is initialised or replaced atomically. The event carries the group name, an array of all new member identities, the OD node, and the result code.
References #
ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD: OpenDirectory Password Modified
#Description
Fires after a password is changed for a user or computer account in OpenDirectory. The event identifies the instigating process, the account type and name, the OD node, and the result code of the change.
References #
ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER: OpenDirectory User Account Disabled
#Description
Fires after a user account is disabled in OpenDirectory. The event identifies the instigating process, the account name, the OD node, and the result code.
References #
ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER: OpenDirectory User Account Enabled
#Description
Fires after a previously disabled user account is re-enabled in OpenDirectory. The event identifies the instigating process, the account name, the OD node, and the result code.
References #
ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_ADD: OpenDirectory Attribute Value Added
#Description
Fires after a single value is appended to an attribute on an OpenDirectory record. The event identifies the instigating process, the record type and name, the attribute name, the new value, the OD node, and the result code.
References #
ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE: OpenDirectory Attribute Value Removed
#Description
Fires after a single value is removed from an attribute on an OpenDirectory record. The event identifies the instigating process, the record type and name, the attribute name, the removed value, the OD node, and the result code.
References #
ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_SET: OpenDirectory Attribute Set (Replaced)
#Description
Fires after all values of an attribute on an OpenDirectory record are replaced atomically. The event carries the record type and name, the attribute name, the full new value array, the OD node, and the result code.
References #
ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER: OpenDirectory User Account Created
#Description
Fires after a new user account is created in OpenDirectory. The event identifies the instigating process, the new account name, the OD node, and the result code.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_od_create_user_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"od_create_user": {
"db_path": "/var/db/dslocal/nodes/Default",
"error_code": 0,
"instigator": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 94961,
"pidversion": 302493,
"rgid": 0,
"ruid": 0
},
"cdhash": "2AC2392B8C46355FFAB5C14D2103DA3EFF5C2ACC",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/sbin/sysadminctl",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 104,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312576273,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 207808,
"st_uid": 0
}
},
"group_id": 94037,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 94960,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 94960,
"pidversion": 302491,
"rgid": 0,
"ruid": 0
},
"ppid": 94960,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 94036,
"signing_id": "com.apple.sysadminctl",
"start_time": "2026-06-22T23:30:48.157971Z",
"team_id": null,
"tty": {
"path": "/dev/ttys005",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:21:30.000000000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:30:43.115608000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 1053,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:30:43.115608000Z",
"st_nlink": 1,
"st_rdev": 268435461,
"st_size": 0,
"st_uid": 0
}
}
},
"instigator_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 94961,
"pidversion": 302493,
"rgid": 0,
"ruid": 0
},
"node_name": "/Local/Default",
"user_name": "dwtmp"
}
},
"event_type": 141,
"global_seq_num": 0,
"mach_time": 8847126652509,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 419,
"pidversion": 985,
"rgid": 0,
"ruid": 0
},
"cdhash": "85D20BDB864F0C3913ED5363D1796EE9562ADBE8",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/opendirectoryd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1520,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575412,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 2185152,
"st_uid": 0
}
},
"group_id": 419,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 419,
"pidversion": 985,
"rgid": 0,
"ruid": 0
},
"session_id": 419,
"signing_id": "com.apple.opendirectoryd",
"start_time": "2026-06-17T20:22:01.686647Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3677737
},
"time": "2026-06-22T23:30:48.352607090Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_OD_CREATE_GROUP: OpenDirectory Group Created
#Description
Fires after a new group is created in OpenDirectory. The event identifies the instigating process, the new group name, the OD node, and the result code.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_od_create_group_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"od_create_group": {
"db_path": "/var/db/dslocal/nodes/Default",
"error_code": 0,
"group_name": "dwtmpgrp",
"instigator": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 95032,
"pidversion": 302635,
"rgid": 0,
"ruid": 0
},
"cdhash": "B3555330E75F3D1D825CDBBB64FF6B02F5F12C4B",
"codesigning_flags": 637606673,
"cs_validation_category": 1,
"executable": {
"path": "/usr/sbin/dseditgroup",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312576013,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 156320,
"st_uid": 0
}
},
"group_id": 94037,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 95031,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 95031,
"pidversion": 302633,
"rgid": 0,
"ruid": 0
},
"ppid": 95031,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 94036,
"signing_id": "com.apple.dseditgroup",
"start_time": "2026-06-22T23:31:25.769190Z",
"team_id": null,
"tty": {
"path": "/dev/ttys005",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:21:30.000000000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:31:20.736689000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 1053,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:31:20.736689000Z",
"st_nlink": 1,
"st_rdev": 268435461,
"st_size": 0,
"st_uid": 0
}
}
},
"instigator_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 95032,
"pidversion": 302635,
"rgid": 0,
"ruid": 0
},
"node_name": "/Local/Default"
}
},
"event_type": 142,
"global_seq_num": 0,
"mach_time": 8848024882907,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 419,
"pidversion": 985,
"rgid": 0,
"ruid": 0
},
"cdhash": "85D20BDB864F0C3913ED5363D1796EE9562ADBE8",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/opendirectoryd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1520,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575412,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 2185152,
"st_uid": 0
}
},
"group_id": 419,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 419,
"pidversion": 985,
"rgid": 0,
"ruid": 0
},
"session_id": 419,
"signing_id": "com.apple.opendirectoryd",
"start_time": "2026-06-17T20:22:01.686647Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3678406
},
"time": "2026-06-22T23:31:25.778538980Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER: OpenDirectory User Account Deleted
#Description
Fires after a user account is deleted from OpenDirectory. The event identifies the instigating process, the deleted account name, the OD node, and the result code.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_od_delete_user_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"od_delete_user": {
"db_path": "/var/db/dslocal/nodes/Default",
"error_code": 0,
"instigator": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 94984,
"pidversion": 302544,
"rgid": 0,
"ruid": 0
},
"cdhash": "2AC2392B8C46355FFAB5C14D2103DA3EFF5C2ACC",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/sbin/sysadminctl",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 104,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312576273,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 207808,
"st_uid": 0
}
},
"group_id": 94037,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 94983,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 94983,
"pidversion": 302542,
"rgid": 0,
"ruid": 0
},
"ppid": 94983,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 94036,
"signing_id": "com.apple.sysadminctl",
"start_time": "2026-06-22T23:30:57.249972Z",
"team_id": null,
"tty": {
"path": "/dev/ttys005",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:21:30.000000000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:30:52.212693000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 1053,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:30:52.212693000Z",
"st_nlink": 1,
"st_rdev": 268435461,
"st_size": 0,
"st_uid": 0
}
}
},
"instigator_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 94984,
"pidversion": 302544,
"rgid": 0,
"ruid": 0
},
"node_name": "/Local/Default",
"user_name": "dwtmp"
}
},
"event_type": 143,
"global_seq_num": 0,
"mach_time": 8847344864339,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 419,
"pidversion": 985,
"rgid": 0,
"ruid": 0
},
"cdhash": "85D20BDB864F0C3913ED5363D1796EE9562ADBE8",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/opendirectoryd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1520,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575412,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 2185152,
"st_uid": 0
}
},
"group_id": 419,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 419,
"pidversion": 985,
"rgid": 0,
"ruid": 0
},
"session_id": 419,
"signing_id": "com.apple.opendirectoryd",
"start_time": "2026-06-17T20:22:01.686647Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3677886
},
"time": "2026-06-22T23:30:57.444685396Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_OD_DELETE_GROUP: OpenDirectory Group Deleted
#Description
Fires after a group account is deleted from OpenDirectory. The event identifies the instigating process, the deleted group name, the OD node, and the result code.
Example Endpoint Security Message #
eslogger captured this on macOS build 25F80. The capture is eslogger's serialization of the whole es_message_t: it expands the message's audit tokens, file stats, and code-signing data into fully resolved fields, so it runs much larger than the base es_event_od_delete_group_t struct.
{
"message": {
"action": {
"result": {
"result": {
"auth": 0
},
"result_type": 0
}
},
"action_type": 1,
"event": {
"od_delete_group": {
"db_path": "/var/db/dslocal/nodes/Default",
"error_code": 0,
"group_name": "dwtmpgrp",
"instigator": {
"audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 95043,
"pidversion": 302657,
"rgid": 0,
"ruid": 0
},
"cdhash": "B3555330E75F3D1D825CDBBB64FF6B02F5F12C4B",
"codesigning_flags": 637606673,
"cs_validation_category": 1,
"executable": {
"path": "/usr/sbin/dseditgroup",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 64,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312576013,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 156320,
"st_uid": 0
}
},
"group_id": 94037,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 95042,
"parent_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 95042,
"pidversion": 302655,
"rgid": 0,
"ruid": 0
},
"ppid": 95042,
"responsible_audit_token": {
"asid": 100026,
"auid": 501,
"egid": 20,
"euid": 501,
"pid": 92091,
"pidversion": 296896,
"rgid": 20,
"ruid": 501
},
"session_id": 94036,
"signing_id": "com.apple.dseditgroup",
"start_time": "2026-06-22T23:31:32.820605Z",
"team_id": null,
"tty": {
"path": "/dev/ttys005",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-06-22T23:21:30.000000000Z",
"st_birthtimespec": "1970-01-01T00:00:00.000000000Z",
"st_blksize": 65536,
"st_blocks": 0,
"st_ctimespec": "2026-06-22T23:31:27.800605000Z",
"st_dev": -1278915369,
"st_flags": 0,
"st_gen": 0,
"st_gid": 4,
"st_ino": 1053,
"st_mode": 8592,
"st_mtimespec": "2026-06-22T23:31:27.800605000Z",
"st_nlink": 1,
"st_rdev": 268435461,
"st_size": 0,
"st_uid": 0
}
}
},
"instigator_token": {
"asid": 100026,
"auid": 501,
"egid": 0,
"euid": 0,
"pid": 95043,
"pidversion": 302657,
"rgid": 0,
"ruid": 0
},
"node_name": "/Local/Default"
}
},
"event_type": 144,
"global_seq_num": 0,
"mach_time": 8848194214163,
"process": {
"audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 419,
"pidversion": 985,
"rgid": 0,
"ruid": 0
},
"cdhash": "85D20BDB864F0C3913ED5363D1796EE9562ADBE8",
"codesigning_flags": 637623057,
"cs_validation_category": 1,
"executable": {
"path": "/usr/libexec/opendirectoryd",
"path_truncated": false,
"stat": {
"st_atimespec": "2026-05-21T08:57:02.000000000Z",
"st_birthtimespec": "2026-05-21T08:57:02.000000000Z",
"st_blksize": 4096,
"st_blocks": 1520,
"st_ctimespec": "2026-05-21T08:57:02.000000000Z",
"st_dev": 16777232,
"st_flags": 524320,
"st_gen": 0,
"st_gid": 0,
"st_ino": 1152921500312575412,
"st_mode": 33261,
"st_mtimespec": "2026-05-21T08:57:02.000000000Z",
"st_nlink": 1,
"st_rdev": 0,
"st_size": 2185152,
"st_uid": 0
}
},
"group_id": 419,
"is_es_client": false,
"is_platform_binary": true,
"original_ppid": 1,
"parent_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 1,
"pidversion": 721,
"rgid": 0,
"ruid": 0
},
"ppid": 1,
"responsible_audit_token": {
"asid": 100025,
"auid": 4294967295,
"egid": 0,
"euid": 0,
"pid": 419,
"pidversion": 985,
"rgid": 0,
"ruid": 0
},
"session_id": 419,
"signing_id": "com.apple.opendirectoryd",
"start_time": "2026-06-17T20:22:01.686647Z",
"team_id": null,
"tty": null
},
"schema_version": 1,
"seq_num": 0,
"thread": {
"thread_id": 3678586
},
"time": "2026-06-22T23:31:32.833944878Z",
"version": 10
}
}
References #
ES_EVENT_TYPE_NOTIFY_XP_MALWARE_DETECTED: XProtect Malware Detected
#Description
Fires when XProtect Remediator or XprotectService detects a known malware signature on the system. The event reports the malware identifier and the path where the threat was found. Only processes holding the com.apple.private.endpoint-security.submit.xp entitlement (namely XProtect daemons) can emit this event.
References #
ES_EVENT_TYPE_NOTIFY_XP_MALWARE_REMEDIATED: XProtect Malware Remediated
#Description
Fires when XProtect Remediator or XprotectService completes a remediation action against previously detected malware. The event records the action taken, whether it succeeded, and optionally the path or process that was remediated. Correlate with xp_malware_detected via incident_identifier.
References #
ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD: Background Task Management Launch Item Added
#Description
Fires when backgroundtaskmanagementd registers a new launch item, including launch agents, launch daemons, and login items added by the user, by MDM, or by an app. The event identifies the instigating process, the app that owns the item, and the item itself including its type and URL.
References #
ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_REMOVE: Background Task Management Launch Item Removed
#Description
Fires when backgroundtaskmanagementd removes a launch item from its registry. The event identifies the instigating process, the owning app, and the item being removed. Correlate with btm_launch_item_add to track the full lifecycle of persistent launch items.
References #
ES_EVENT_TYPE_NOTIFY_PROFILE_ADD: Configuration Profile Installed
#Description
Fires when mdmclient installs a configuration profile on the system. The event reports the instigating process, whether this is an update to an existing profile, and profile metadata including its identifier, UUID, display name, organization, scope, and install source.
References #
ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE: Configuration Profile Removed
#Description
Fires when mdmclient removes a configuration profile from the system. The event reports the instigating process and the metadata of the profile that was removed, allowing defenders to detect unauthorized removal of MDM enrollment or security policy profiles.
References #
ES_EVENT_TYPE_NOTIFY_GATEKEEPER_USER_OVERRIDE: Gatekeeper User Override
#Description
Fires when a user explicitly overrides a Gatekeeper block to run an app or file that macOS would otherwise refuse to open. The event identifies the target file or path and, where available, its SHA-256 hash and code signing information.
References #
ES_EVENT_TYPE_NOTIFY_TCC_MODIFY: TCC Privacy Permission Modified
#Description
Fires when a Transparency, Consent, and Control (TCC) privacy permission is granted or revoked for an application. The event identifies the protected service, the application whose access changed, the type of change, the resulting permission right, and the reason for the update. Added in macOS 15.4 as the first native ESF hook for TCC database modifications.
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
subsystem | eq | com.apple.tcc | 1 rule | sigma |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #