Environment
- EDR Apple MacOS Sensor: 7.3.0 and higher
- Apple MacOS: 11 Big Sur and higher
Symptoms
- No longer seeing events related to system dylib loads
- Toggling the Filter Known Modules option in Advanced Sensor Group Settings has no effect
Cause
Starting from MacOS 11 BigSur, the OS protects against system library file tampering by loading libraries from trusted prebuilt cache instead of disk.
Resolution
EDR sensors running on MacOS 11 BigSur and higher systems would not report modload events for such system library files and there is no effect of “Filter known modloads” advanced sensor group level setting on these events.
Additional Notes
- Dynamically loaded code (typically dylibs on macOS) are classified into two categories.
- System dylib - typically bundled with OS/system software.
- Application specific/third party dylib (non system dylibs)
- As part of telemetry, the EDR sensor would report events for loading of such dylibs and the “Filter known modloads” feature if enabled filters out system dylib load events.
- This issue should not impact the application specific/third-party dylibs, only the system dylibs
Related Content
