Ensure XProtect Is Running and Updated

AltaNivel 1Automatizadamacos

Descripción

XProtect is Apple's native signature-based antivirus technology. XProtect both finds and blocks the execution of known malware. There are many AV and Endpoint Detection and Response (EDR) tools available for macOS. The native Apple provisioned tool looks for specific known malware and is completely integrated into the OS. No matter what other tools are being used, XProtect should have the latest signatures available. Audit: Checks xprotect status; confirm definitions are current with xprotect check / xprotect update.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(/usr/bin/xprotect status 2>/dev/null) || exit 1
if printf '%s\n' "$out" | /usr/bin/grep -q "XProtect launch scans: enabled" && printf '%s\n' "$out" | /usr/bin/grep -q "XProtect background scans: enabled"; then echo compliant; else printf '%s\n' "$out"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Terminal: sudo /bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XProtect.daemon.scan.pl ist ; sudo /bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XprotectFramework.Plugi nService.plist ; sudo /usr/bin/xprotect update.

Propiedades

Sistemas operativos: macos-26
Etiquetas: macossystem-access
Referencia: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.10 Ensure XProtect Is Running and Updated

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos