XProtect and XProtect BehaviorService: previous research

Thu, 16 Apr 2026 00:00:00 +0000

Recently started looking into macOS’ XProtect and its satellites. There are a few interesting presentations and articles from previous research done in the last years. I mainly want to capture some of the ones that I already went through and found valuable before I publish some of my own findings, learnings and failures.

The following two presentations are particularly interesting on what XProtect is and XProtect Remediator:

I heard about XProtect before, maybe around end of 2024 or so, but never had the interest to research it. But with some of the latest updates related to clipboard pasting and ClickFix campaigns, my interest grew so I started looking into how this works. My own research, so far, for this XProtect feature hasn’t uncovered anything new than what is detailed in this high quality research done by Patrick Wardle.

A quick first look at macOS PowerLogs

Sun, 09 Nov 2025 13:58:41 +0100

Intro

Hi there!

As I mentioned in my previous post - Latest goodies October #1 - there were a few interesting presentations at OBTS v8.0 which motivated me to learn more about macOS and *OS platforms. One of the most interesting ones was Sarah Edwards’s - The Power of Powerlogs. All presentations, slides and videos are on OBTS - Talks page. I was aware of macOS’ powerlogs (most probably from Sarah’s blog), however I never spent time investigating them in detail and learning about their structure. This time it seems like a good opportunity to do so.

Macos on cpus.me

XProtect and XProtect BehaviorService: previous research

A quick first look at macOS PowerLogs

Intro