Techniques › T1559.003 › AN0948
AN0948 Analytic 0948
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects anomalous use of macOS XPC services for code execution. Monitors for processes invoking privileged XPC daemons with abnormal parameters, unexpected binaries communicating over NSXPCConnection, or helper tools executing code outside of their expected parent process lineage. Correlates process access attempts to system-level daemons, privilege escalations via XPC misconfigurations, and injection of malicious payloads through inter-process communication.</p>
- Detects
- T1559.003 XPC Services
- Part of
- DET0335 Detect Abuse of XPC Services (T1559.003)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Unexpected NSXPCConnection calls by non-Apple-signed or abnormal binaries | DC0035 Process Access |
| macos:unifiedlog | execve: Helper tools invoked through XPC executing unexpected binaries | DC0032 Process Creation |
| macos:unifiedlog | XPC messages requesting privileged actions from untrusted or unsigned clients | DC0048 Named Pipe Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedXPCClients | Maintain allowlist of binaries permitted to invoke specific XPC services to minimize false positives. |
TimeWindow | Threshold for correlating abnormal XPC requests with subsequent privilege escalation or process creation. |
UnsignedBinaryAlertLevel | Adjust sensitivity of alerts for unsigned or non-Apple-signed clients initiating XPC communication. |