macOS splits big applications into pieces so that the part with root powers stays small. The pieces talk over XPC. XPC Services (T1559.003) is an Execution technique for macOS and a subtechnique of Inter-Process Communication.
How attackers use it
MITRE explains that macOS uses XPC services for basic IPC between processes, such as between the XPC Service daemon and a third-party application's privileged helper tools. Applications send messages to the XPC Service daemon, which runs as root, using the low-level C API or the higher-level NSXPCConnection API, to handle tasks that need elevated privileges, such as network connections. Applications supply a protocol definition that acts as a blueprint of the service. Developers use XPC for stability and privilege separation.
Adversaries can pass malicious content through the application's XPC handler. MITRE adds that this may involve finding and abusing improper XPC client validation or poor sanitization of input parameters, which can lead to Exploitation for Privilege Escalation.
How to detect it
MITRE's analytic watches for processes calling privileged XPC daemons with abnormal parameters, unexpected binaries communicating over NSXPCConnection, and helper tools executing code outside their expected parent process lineage. It also looks at process access to system-level daemons, privilege escalation through XPC misconfigurations, and malicious payloads injected through IPC.
How to reduce the risk
MITRE lists one mitigation, aimed at developers: application developer guidance. Enable the Hardened Runtime capability when building applications, and do not include the com.apple.security.get-task-allow entitlement set to any variation of true.
If you ship macOS software with privileged helpers, add the obvious companion step: validate who is on the other end of every connection and treat every parameter as untrusted input.
Quick check
What two weaknesses does MITRE say make XPC abuse possible?
Improper validation of the XPC client, and poor sanitization of input parameters.
