How to Deploy Apple Endpoint Security Framework (ESF) for macOS Threat Hunting

For years, macOS security software relied on Kernel Extensions (Kexts). To monitor file system activity or intercept malicious processes, antivirus vendors had to write code that ran directly inside the macOS kernel. This was catastrophic for system stability. A single bug in a third-party antivirus Kext would instantly trigger a kernel panic, crashing the entire Mac.

Apple eliminated this vulnerability with the introduction of the Endpoint Security Framework (ESF). ESF is a highly privileged, Apple-vetted C API that operates entirely in user space. It provides a formalized, bidirectional communication channel between the macOS kernel and authorized security applications.

By leveraging ESF, security engineers and threat hunters can subscribe to real-time, granular system events (like process executions, file modifications, and kernel module loads) without risking system stability. This guide explains the architecture of the Endpoint Security Framework and how to configure tools to ingest its telemetry.

Understanding the ESF Architecture

The Endpoint Security Framework is not a tool you run; it is a developer framework (EndpointSecurity.framework). The architecture consists of three components:

1. The Kernel Subsystem: The macOS kernel generates events (e.g., an execve system call when a user opens Terminal).
2. The ESF Daemon (endpointsecurityd): This Apple daemon acts as the broker. It receives events from the kernel and routes them to authorized clients.
3. The ES Client: A third-party application (like CrowdStrike, Jamf Protect, or an open-source tool) that subscribes to these events.

ESF operates in two distinct modes:

• AUTH (Authorization): The ES Client can block actions. When the user double-clicks an application, the kernel pauses the launch and asks the ES Client for permission. If the client identifies malware, it returns ES_AUTH_RESULT_DENY, and the kernel blocks the execution.
• NOTIFY: The ES Client acts purely as an observer, logging telemetry for Threat Hunting without interfering with the OS.

Step 1: The Code Signing Requirement

You cannot simply write a Python script to connect to ESF. Apple heavily restricts access to this framework to prevent malware from using it to spy on the system.

To compile an ES Client, the binary must be signed with an Apple Developer Certificate that includes a specific, restricted entitlement: com.apple.developer.endpoint-security.client.

To obtain this entitlement, your organization must submit a formal request to Apple detailing exactly why you need to build endpoint security software. Because of this hurdle, most systems administrators deploy pre-compiled, Apple-vetted open-source tools (like Objective-See’s tools or Osquery) rather than writing custom ES clients.

Step 2: Deploying the ESF Payload via MDM

Even if an application possesses the correct Apple entitlement, macOS will still block it from running unless a local administrator explicitly grants it Full Disk Access (FDA) in System Settings.

In an enterprise environment, you cannot rely on end-users to click through complex security prompts. You must deploy a Privacy Preferences Policy Control (PPPC) payload via your Mobile Device Management (MDM) server.

1. Create a new macOS Configuration Profile in your MDM.
2. Select the Privacy Preferences Policy Control payload.
3. Define the Identifier and Code Requirement of the specific ES Client you are deploying (e.g., the specific Team ID of the vendor).
4. Under the SystemPolicyAllFiles (Full Disk Access) category, set the action to Allow.
5. Deploy the profile to your fleet. The ES client will now be authorized to connect to the ESF daemon silently.

Step 3: Leveraging Endpoint Security for Threat Hunting

To practically utilize ESF without buying an enterprise EDR, you can use the open-source Crescendo tool (by Stephen Davis) or Apple’s own eslogger command-line utility (introduced in macOS Ventura).

Let’s use eslogger. This native tool allows administrators to stream ESF events directly to JSON without writing any C code.

To capture all process execution events (detecting when an attacker drops and runs a malicious binary):

sudo eslogger exec

As you open applications, eslogger will dump massive JSON payloads detailing the process path, the code signature status, and the ancestral PID tree (allowing you to prove that Python was launched by a reverse shell originating from sh).

Step 4: Auditing File Modifications (FIM)

Threat hunters often monitor the /Library/LaunchDaemons directory to detect persistence mechanisms.

You can instruct eslogger to monitor the rename and create events:

sudo eslogger rename create | grep "LaunchDaemons"

This streams real-time JSON. If a threat actor drops a plist file into that directory to establish persistence across reboots, the ESF daemon instantly captures the event, identifying exactly which process (down to the audit token and UID) created the file.

Conclusion

The Endpoint Security Framework is the most powerful security mechanism in modern macOS. By removing unstable Kernel Extensions and replacing them with a highly structured, user-space event pipeline, Apple has empowered enterprise security teams to perform deep, cryptographic threat hunting and behavioral analysis with absolute system stability.