An attacker can register for system notification keys to detect when the user locks their screen, changes network state, or other system events without using more easily detected APIs. The following example monitors for screen lock events.
notifyutil-wcom.apple.screenIsLocked
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery, Collection
Detection
Monitor notifyutil execution with suspicious notification keys: Monitor notifyutil execution with suspicious notification keys
Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple): Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)
Monitor long-running notifyutil processes (using -w flag for sustained monitoring): Monitor long-running notifyutil processes (using -w flag for sustained monitoring)
Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes: Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes
Establish covert inter-process communication channel
Defense EvasionmacOS
Threat actors can use Darwin notifications as a covert IPC mechanism to coordinate between malicious processes. By posting and monitoring custom notification keys with associated state values, malware components can exchange commands and data without using traditional IPC methods that may be monitored.
# Sender processnotifyutil-pcom.example.hidden.channel-scom.example.hidden.channel1337# Receiver process in another terminal/processnotifyutil-1com.example.hidden.channel-gcom.example.hidden.channel
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Command and Control, Defense Evasion
Detection
Monitor notifyutil execution with suspicious notification keys: Monitor notifyutil execution with suspicious notification keys
Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple): Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)
Monitor long-running notifyutil processes (using -w flag for sustained monitoring): Monitor long-running notifyutil processes (using -w flag for sustained monitoring)
Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes: Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes
Monitor network state changes for data exfiltration timing
DiscoveryCollectionmacOS
An attacker can monitor for network configuration changes to determine optimal timing for data exfiltration. This allows malware to detect when the system connects to networks and adjust behavior accordingly.
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery, Collection
Detection
Monitor notifyutil execution with suspicious notification keys: Monitor notifyutil execution with suspicious notification keys
Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple): Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)
Monitor long-running notifyutil processes (using -w flag for sustained monitoring): Monitor long-running notifyutil processes (using -w flag for sustained monitoring)
Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes: Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes
Monitoring timezone change notifications can help an attacker track when a target device moves between geographic locations or when users travel, providing intelligence about the target's physical location and movement patterns.
notifyutil-wcom.apple.system.timezone
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Collection, Discovery
Detection
Monitor notifyutil execution with suspicious notification keys: Monitor notifyutil execution with suspicious notification keys
Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple): Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)
Monitor long-running notifyutil processes (using -w flag for sustained monitoring): Monitor long-running notifyutil processes (using -w flag for sustained monitoring)
Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes: Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes
Monitor login/logout events for privilege escalation timing
DiscoveryPrivilege EscalationmacOS
By monitoring authentication-related notification keys, an attacker can detect login and logout events to time privilege escalation attempts or other malicious activities when defenses may be weakened during authentication transitions.
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery, Privilege Escalation
Detection
Monitor notifyutil execution with suspicious notification keys: Monitor notifyutil execution with suspicious notification keys
Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple): Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)
Monitor long-running notifyutil processes (using -w flag for sustained monitoring): Monitor long-running notifyutil processes (using -w flag for sustained monitoring)
Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes: Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes
Query system notification state values for reconnaissance
DiscoverymacOS
Threat actors can query state values of system notification keys to gather information about the current system configuration without executing more suspicious commands.
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery
Detection
Monitor notifyutil execution with suspicious notification keys: Monitor notifyutil execution with suspicious notification keys
Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple): Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)
Monitor long-running notifyutil processes (using -w flag for sustained monitoring): Monitor long-running notifyutil processes (using -w flag for sustained monitoring)
Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes: Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes