detection.wiki

Detection rules › Sigma

XPC Connection from Unusual Location

Status
experimental
Severity
medium
Log source
category xpc_connection, product macos, service endpointsecurity
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects XPC service connections initiated from unusual file system locations

Known false positives

  • Installers running from temporary locations
  • User scripts

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

PlatformRecord / event type
macOSESF event xpc_connect (NOTIFY): Fires when a process establishes a connection to a named XPC service, reporting the service name and the domain type in which that service resides.

Rule body

title: XPC Connection from Unusual Location
id: 4fdd0c51-2354-414b-b74d-45b634d0fcb4
status: experimental
description: Detects XPC service connections initiated from unusual file system locations
references:
- https://attack.mitre.org/techniques/T1559/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.execution
- attack.t1559
logsource:
  product: macos
  service: endpointsecurity
  category: xpc_connection
detection:
  selection:
    esf.event_type: 65
    event.action: xpc_connect
    Image|startswith:
    - /tmp/
    - /var/tmp/
    - /private/tmp/
    - /Users/Shared/
    - /dev/shm/
  condition: selection
falsepositives:
- Installers running from temporary locations
- User scripts
level: medium
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  esf.event_type: 65
  event.action: xpc_connect
  Image|startswith:
  - /tmp/
  - /var/tmp/
  - /private/tmp/
  - /Users/Shared/
  - /dev/shm/

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Imagestarts_with
  • /Users/Shared/
  • /dev/shm/
  • /private/tmp/
  • /tmp/
  • /var/tmp/
field:"Image" kind:starts_with
esf.event_typeeq
  • 65
field:"esf.event_type" kind:eq value:"65"
event.actioneq
  • xpc_connect
field:"EventType" kind:eq value:"xpc_connect"