macOS Endpoint Security framework events

License or service

Apple ES (entitlement required)

What is free

Framework in OS

What costs

Entitlement "must request from Apple"; ES clients may be commercial

Vendor page

https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.developer.endpoint-security.client.md

As read on

2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

• T1027.002 Software Packing
• T1027.008 Stripped Payloads
• T1027.009 Embedded Payloads
• T1027.010 Command Obfuscation
• T1027.013 Encrypted/Encoded File
• T1027.014 Polymorphic Code
• T1027.016 Junk Code Insertion
• T1027.017 SVG Smuggling
• T1029 Scheduled Transfer
• T1030 Data Transfer Size Limits
• T1033 System Owner/User Discovery
• T1036 Masquerading
• T1036.001 Invalid Code Signature
• T1036.002 Right-to-Left Override
• T1036.003 Rename Legitimate Utilities
• T1036.004 Masquerade Task or Service
• T1055 Process Injection
• T1068 Exploitation for Privilege Escalation
• T1102.003 One-Way Communication
• T1104 Multi-Stage Channels
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1114 Email Collection
• T1125 Video Capture
• T1129 Shared Modules
• T1132.002 Non-Standard Encoding
• T1135 Network Share Discovery
• T1195 Supply Chain Compromise
• T1195.001 Compromise Software Dependencies and Development Tools
• T1195.002 Compromise Software Supply Chain
• T1195.003 Compromise Hardware Supply Chain
• T1204.002 Malicious File
• T1546.004 Unix Shell Configuration Modification
• T1547.007 Re-opened Applications
• T1552.003 Shell History