Detection rules › Sigma
macOS XPC Service Abuse
Detects potential abuse of XPC (Inter-Process Communication) services. XPC is used for secure communication between processes, but can be abused for privilege escalation or accessing protected system services.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1559 Inter-Process Communication |
Rule body yaml
title: macOS XPC Service Abuse
id: e5f6a7b8-c9d0-4123-ef01-234567890123
status: experimental
description: |
Detects potential abuse of XPC (Inter-Process Communication) services.
XPC is used for secure communication between processes, but can be abused
for privilege escalation or accessing protected system services.
references:
- https://attack.mitre.org/techniques/T1559/
- https://wojciechregula.blog/post/learn-xpc-exploitation-part-1/
author: Eric Brown - Nebulock, Inc.
date: 2025/01/22
modified: 2025/01/22
logsource:
product: macos
service: unifiedlog
detection:
selection_subsystem:
subsystem: com.apple.xpc
selection_sensitive_services:
message|contains:
- 'com.apple.security'
- 'com.apple.authd'
- 'com.apple.coreservices.launchservicesd'
- 'com.apple.TCC'
- 'com.apple.system.DirectoryService'
selection_indicators:
message|contains:
- 'connection rejected'
- 'denied'
- 'invalid entitlement'
- 'unauthorized'
- 'suspicious'
condition: selection_subsystem and selection_sensitive_services and selection_indicators
falsepositives:
- Legitimate applications with missing entitlements
- Development/testing environments
level: medium
tags:
- attack.privilege_escalation
- attack.execution
- attack.t1559
Stages and Predicates
Stage 0: condition
selection_subsystem and selection_sensitive_services and selection_indicatorsStage 1: selection_subsystem
selection_subsystem:
subsystem: com.apple.xpc
Stage 2: selection_sensitive_services
selection_sensitive_services:
message|contains:
- 'com.apple.security'
- 'com.apple.authd'
- 'com.apple.coreservices.launchservicesd'
- 'com.apple.TCC'
- 'com.apple.system.DirectoryService'
Stage 3: selection_indicators
selection_indicators:
message|contains:
- 'connection rejected'
- 'denied'
- 'invalid entitlement'
- 'unauthorized'
- 'suspicious'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.