Skip to content
Threat Feed

Product

BlockBlock

2 briefs RSS
medium advisory

macOS Kernel-to-Userland Process Creation Notification via undocumented kev_msg_post

The kev_msg_post function can be abused by malware to broadcast process creation notifications from a kernel extension (kext) to a user-mode application, potentially bypassing security tools that rely on standard APIs and leading to undetected malicious activity.

BlockBlock kernel-extension kev_msg_post macos process-monitoring
2r
medium advisory

macOS File Monitoring via Endpoint Security Framework

Objective-See details how to create a file monitor for macOS 10.15 using Apple's Endpoint Security Framework to capture file I/O events and process information.

macOS +6 file-monitoring endpoint-security
2r 1t