Introduction to macOS - XProtect

Continuing my blogpost series on intoruction to macOS, I've decided to dedicate a short blogpost to XProtect.

What is XProtect?

XProtect is Apple's built-in antivirus and malware signature system for macOS.
It operates as part of the XProtectService, which scans applications and other executable content for known malware signatures.
XProtect works in the background and is updated silently by Apple through the XProtectRemediator mechanism (more on that later).
It has 3 primary functions:

• Signature-based detection – It scans files against a database of known malware signatures.
• Behavioral detection (XProtect Remediator) – Introduced in macOS Monterey, this allows XProtect to proactively scan for and remove malware based on suspicious behaviors rather than just static signatures.
• Real-time blocking – XProtect prevents execution of known malicious software before it can run.

Traditional XProtect

The directory /Library/Apple/System/Library/CoreServices/XProtect.bundle is the main bundle that contains the XProtect configuration and signature definitions.
This is a read-only system directory and is updated silently by Apple via XProtect updates.
Under it, we can find some files of interest, all periodically updated by Apple and protected by System Integrity Protection (SIP).

XProtect.plist

The file /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist stores malware signatures used by XProtect to detect known threats.
It contains entries mapping malware families to specific detection rules, including hashes and filename patterns.
Here is an example of one malware family - Bundalore:

<dict>
        <key>Description</key>
        <string>OSX.Bundlore.D</string>
        <key>LaunchServices</key>
        <dict>
                <key>LSItemContentType</key>
                <string>com.apple.application-bundle</string>
        </dict>
        <key>Matches</key>
        <array>
                <dict>
                        <key>MatchFile</key>
                        <dict>
                                <key>NSURLTypeIdentifierKey</key>
                                <string>com.apple.applescript.script</string>
                        </dict>
                        <key>MatchType</key>
                        <string>Match</string>
                        <key>Pattern</key>
                        <string>46617364554153</string>
                </dict>
                <dict>
                        <key>MatchFile</key>
                        <dict>
                                <key>NSURLTypeIdentifierKey</key>
                                <string>com.apple.applescript.script</string>
                        </dict>
                        <key>MatchType</key>
                        <string>Match</string>
                        <key>Pattern</key>
                        <string>20006500630068006F002000</string>
                </dict>
                <dict>
                        <key>MatchFile</key>
                        <dict>
                                <key>NSURLTypeIdentifierKey</key>
                                <string>com.apple.applescript.script</string>
                        </dict>
                        <key>MatchType</key>
                        <string>Match</string>
                        <key>Pattern</key>
                        <string>20007C0020006F00700065006E00730073006C00200065006E00630020002D006100650073002D003200350036002D0063006600620020002D007000610073007300200070006100730073003A</string>
                </dict>
                <dict>
                        <key>MatchFile</key>
                        <dict>
                                <key>NSURLTypeIdentifierKey</key>
                                <string>com.apple.applescript.script</string>
                        </dict>
                        <key>MatchType</key>
                        <string>Match</string>
                        <key>Pattern</key>
                        <string>002D00730061006C00740020002D00410020002D00610020002D00640020007C002000620061007300680020002D0073</string>
                </dict>
        </array>
</dict>

This is quite human-readable, the only noteworthy part is that the string argument in each match is hexadecimal-representation, e.g. 002D00730061006C00740020002D00410020002D00610020002D00640020007C002000620061007300680020002D0073 corresponds to -salt -A -a -d | bash -s.
This is, of course, a goldmine for malware authors, that know exactly which patterns to avoid.

XProtect.meta.plist

The file /Library/Apple/System/Library/CoreServices/XProtect.bundle/XProtect.meta.plist is a metadata file that defines additional rules for XProtect, including enforcement policies and versioning information.
It specifies which macOS versions enforce certain XProtect rules and actions taken upon detection, as well as blacklists for plugins.
Here is an example:

<key>JavaWebComponentVersionMinimum</key>
<string>1.6.0_45-b06-451</string>
<key>PlugInBlacklist</key>
<dict>
        <key>10</key>
        <dict>
                <key>com.apple.java.JavaAppletPlugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>14.8.0</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.apple.java.JavaPlugin2_NPAPI</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>14.8.0</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.macromedia.Flash Player ESR.plugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>18.0.0.382</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.macromedia.Flash Player.plugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>32.0.0.101</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.microsoft.SilverlightPlugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>5.1.41212.0</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
                <key>com.oracle.java.JavaAppletPlugin</key>
                <dict>
                        <key>MinimumPlugInBundleVersion</key>
                        <string>1.8.51.16</string>
                        <key>PlugInUpdateAvailable</key>
                        <true/>
                </dict>
        </dict>
</dict>

As you can see, those contain version information for "blacklisted" plugins, for instance.

XProtect.yara

In recent versions, XProtect seems to have started supporing YARA.
The file /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara contains several YARA rules in a text-format, here's a short example from it: