Skip to content
Threat Feed

Tag

Process-Monitoring

2 briefs RSS
medium advisory

macOS Kernel-to-Userland Process Creation Notification via undocumented kev_msg_post

The kev_msg_post function can be abused by malware to broadcast process creation notifications from a kernel extension (kext) to a user-mode application, potentially bypassing security tools that rely on standard APIs and leading to undetected malicious activity.

BlockBlock kernel-extension kev_msg_post macos process-monitoring
2r
medium advisory

Leveraging Apple's Endpoint Security Framework for Process Monitoring

This brief discusses the use of Apple's Endpoint Security Framework in macOS 10.15 and later for user-mode process monitoring, offering improved capabilities over the older OpenBSM subsystem.

macOS endpoint-security process-monitoring defense-evasion discovery
2r 2t