Detection rules › Sigma

macOS XPC Service Abuse

Status
experimental
Severity
medium
Log source
product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects potential abuse of XPC (Inter-Process Communication) services. XPC is used for secure communication between processes, but can be abused for privilege escalation or accessing protected system services.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1559 Inter-Process Communication

Rule body yaml

title: macOS XPC Service Abuse
id: e5f6a7b8-c9d0-4123-ef01-234567890123
status: experimental
description: |
  Detects potential abuse of XPC (Inter-Process Communication) services.
  XPC is used for secure communication between processes, but can be abused
  for privilege escalation or accessing protected system services.
references:
  - https://attack.mitre.org/techniques/T1559/
  - https://wojciechregula.blog/post/learn-xpc-exploitation-part-1/
author: Eric Brown - Nebulock, Inc.
date: 2025/01/22
modified: 2025/01/22
logsource:
  product: macos
  service: unifiedlog
detection:
  selection_subsystem:
    subsystem: com.apple.xpc
  selection_sensitive_services:
    message|contains:
      - 'com.apple.security'
      - 'com.apple.authd'
      - 'com.apple.coreservices.launchservicesd'
      - 'com.apple.TCC'
      - 'com.apple.system.DirectoryService'
  selection_indicators:
    message|contains:
      - 'connection rejected'
      - 'denied'
      - 'invalid entitlement'
      - 'unauthorized'
      - 'suspicious'
  condition: selection_subsystem and selection_sensitive_services and selection_indicators
falsepositives:
  - Legitimate applications with missing entitlements
  - Development/testing environments
level: medium
tags:
  - attack.privilege_escalation
  - attack.execution
  - attack.t1559

Stages and Predicates

Stage 0: condition

selection_subsystem and selection_sensitive_services and selection_indicators

Stage 1: selection_subsystem

selection_subsystem:
  subsystem: com.apple.xpc

Stage 2: selection_sensitive_services

selection_sensitive_services:
  message|contains:
    - 'com.apple.security'
    - 'com.apple.authd'
    - 'com.apple.coreservices.launchservicesd'
    - 'com.apple.TCC'
    - 'com.apple.system.DirectoryService'

Stage 3: selection_indicators

selection_indicators:
  message|contains:
    - 'connection rejected'
    - 'denied'
    - 'invalid entitlement'
    - 'unauthorized'
    - 'suspicious'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
messagematch
  • com.apple.TCC
  • com.apple.authd
  • com.apple.coreservices.launchservicesd
  • com.apple.security
  • com.apple.system.DirectoryService
  • connection rejected
  • denied
  • invalid entitlement
  • suspicious
  • unauthorized
subsystemeq
  • com.apple.xpc