macOS Configuration Profile Installation

Status: experimental
Severity: medium
Log source: product macos, service endpointsecurity
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects installation of configuration profiles which can be used for persistence, privilege escalation, or to modify system security settings. Malicious profiles can disable security features, install certificates, or configure system settings.

Known false positives

MDM (Mobile Device Management) profile installations
IT-managed configuration profiles
Legitimate user-installed profiles
VPN and network configuration profiles

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547` Boot or Logon Autostart Execution `T1556` Modify Authentication Process

Rule body

title: macOS Configuration Profile Installation
id: e429564d-e697-4ecc-8996-504474e414f4
status: experimental
description: 'Detects installation of configuration profiles which can be used for
  persistence,

  privilege escalation, or to modify system security settings. Malicious profiles

  can disable security features, install certificates, or configure system settings.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1547/
- https://attack.mitre.org/techniques/T1556/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type:
    - 126  # ES_EVENT_TYPE_NOTIFY_PROFILE_ADD
    - 127  # ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE
  selection_root:
    UserId: 0
  condition: selection_event and not selection_root
falsepositives:
- MDM (Mobile Device Management) profile installations
- IT-managed configuration profiles
- Legitimate user-installed profiles
- VPN and network configuration profiles
fields:
- event_type
- event_name
- User
- profile_identifier
- profile_uuid
tags:
- attack.persistence
- attack.t1547
- attack.t1556
level: medium

Stages and Predicates

Stage 0: `condition`

selection_event and not selection_root

Stage 1: `selection_event`

selection_event:
  esf.event_type:
  - 126
  - 127

Stage 2: `not selection_root`

selection_root:
  UserId: 0

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`UserId`	eq	`0`	`excludes:UserId` `field:"UserId" value:"0"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`esf.event_type`	eq	`126` `127`	`field:"esf.event_type" kind:eq`