Ensure XProtect Is Running and Updated

ÉlevéeNiveau 1Automatiséemacos

Description

XProtect is Apple's native signature-based antivirus technology. XProtect both finds and blocks the execution of known malware. There are many AV and Endpoint Detection and Response (EDR) tools available for macOS. The native Apple provisioned tool looks for specific known malware and is completely integrated into the OS. No matter what other tools are being used, XProtect should have the latest signatures available. Audit: Checks xprotect status; confirm definitions are current with xprotect check / xprotect update.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(/usr/bin/xprotect status 2>/dev/null) || exit 1
if printf '%s\n' "$out" | /usr/bin/grep -q "XProtect launch scans: enabled" && printf '%s\n' "$out" | /usr/bin/grep -q "XProtect background scans: enabled"; then echo compliant; else printf '%s\n' "$out"; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Terminal: sudo /bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XProtect.daemon.scan.pl ist ; sudo /bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XprotectFramework.Plugi nService.plist ; sudo /usr/bin/xprotect update.

Propriétés

Systèmes d'exploitation: macos-26
Étiquettes: macossystem-access
Référence: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.10 Ensure XProtect Is Running and Updated

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target macos