T1559.003 — XPC Services
Tactic: Execution · Platforms: macOS
Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send…
Sub-technique of Inter-Process Communication (T1559).
Sigma detection rules (1)
T1559.003 Inter-Process Communication: XPC Services
title: "T1559.003 Inter-Process Communication: XPC Services"
id: 891b8b14-0e15-4a5a-ac5b-868613877513
description: 'Detect Abuse of XPC Services (T1559.003). (Retargeted to the process_access macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedXPCClients, TimeWindow, UnsignedBinaryAlertLevel.'
references:
- https://attack.mitre.org/techniques/T1559/003
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
- attack.execution
- attack.t1559.003
logsource:
category: process_access
product: macos
detection:
selection:
TargetImage|contains: '.xpc'
filter_apple:
SourceImage|startswith: '/System/Library/'
condition: selection and not filter_apple
falsepositives:
- Third-party applications legitimately using their own signed XPC helper services for sandboxed privilege separation.
level: medium
Related sub-techniques
Explore