macOS XProtect Malware Detection

Status: experimental
Severity: critical
Log source: product macos, service endpointsecurity
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects XProtect malware detection and remediation events. XProtect is Apple's built-in malware detection system. These events indicate confirmed malware presence and should trigger immediate incident response.

Known false positives

Security testing with known malware samples
False positives from XProtect signatures (rare)

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204` User Execution

Rule body

title: macOS XProtect Malware Detection
id: c1a51851-4230-4141-9601-5d9f0cde7b96
status: experimental
description: 'Detects XProtect malware detection and remediation events. XProtect
  is Apple''s

  built-in malware detection system. These events indicate confirmed malware

  presence and should trigger immediate incident response.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1204/
- https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_detected:
    esf.event_type: 112
    event.action: xp_malware_detected
  selection_remediated:
    esf.event_type: 113
    event.action: xp_malware_remediated
  condition: selection_detected or selection_remediated
falsepositives:
- Security testing with known malware samples
- False positives from XProtect signatures (rare)
fields:
- event_type
- event_name
- ProcessId
- Image
- User
- file_path
tags:
- attack.execution
- attack.t1204
- attack.initial_access
level: critical

Stages and Predicates

Stage 0: `condition`

selection_detected or selection_remediated

Stage 1: `selection_detected`

selection_detected:
  esf.event_type: 112
  event.action: xp_malware_detected

Stage 2: `selection_remediated`

selection_remediated:
  esf.event_type: 113
  event.action: xp_malware_remediated

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`esf.event_type`	eq	`112` `113`	`field:"esf.event_type" kind:eq`
`event.action`	eq	`xp_malware_detected` `xp_malware_remediated`	`field:"EventType" kind:eq`