Home / Companies / Elastic / Blog / Post Details
Content Deep Dive

Mac system extensions for threat detection: Part 3

Blog post from Elastic

Post Details
Company
Date Published
Author
Will Yu
Word Count
3,131
Company Posts That Month
34
Language
-
Hacker News Points
-
Post removed?
No
Summary

In the final installment of a series on Mac system extensions for threat detection, the shift from kernel extensions to Apple's new EndpointSecurity and SystemExtensions frameworks is explored. Announced at WWDC 2019, these frameworks will replace kernel extensions in macOS 10.16, as third-party vendors will no longer be permitted to run in the kernel. The EndpointSecurity framework offers a userland alternative to the in-kernel Kauth and MAC frameworks, providing detailed system event information and allowing developers to more easily debug their applications. SystemExtensions, which run in user mode, mitigate the risks associated with kernel code development by enabling modern debugging tools and preventing system crashes from faulty code. These frameworks are tailored to enhance security applications by allowing event subscription, authorization, and notification handling through userland APIs, thus improving development efficiency and system stability.

Trends Found in this Post

No tracked trend matches for this post yet.

Use This Data

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.