Ensure XProtect Is Running and Updated

AltaNível 1Automatizadamacos

Descrição

XProtect is Apple's native signature-based antivirus technology. XProtect both finds and blocks the execution of known malware. There are many AV and Endpoint Detection and Response (EDR) tools available for macOS. The native Apple provisioned tool looks for specific known malware and is completely integrated into the OS. No matter what other tools are being used, XProtect should have the latest signatures available. Audit: Checks xprotect status; confirm definitions are current with xprotect check / xprotect update.

Como é verificado

Método de auditoria: Comando shell

shell

out=$(/usr/bin/xprotect status 2>/dev/null) || exit 1
if printf '%s\n' "$out" | /usr/bin/grep -q "XProtect launch scans: enabled" && printf '%s\n' "$out" | /usr/bin/grep -q "XProtect background scans: enabled"; then echo compliant; else printf '%s\n' "$out"; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Terminal: sudo /bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XProtect.daemon.scan.pl ist ; sudo /bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XprotectFramework.Plugi nService.plist ; sudo /usr/bin/xprotect update.

Propriedades

Sistemas operacionais: macos-26
Tags: macossystem-access
Referência: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.10 Ensure XProtect Is Running and Updated

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target macos