macOS XPC Service Abuse via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects potential macOS XPC Service abuse via remote SSH. Specifically, it looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "launchctl" and "submit" (case-insensitive). This combination suggests an attempt to use the launchctl command to submit a job, potentially exploiting XPC services, over an SSH connection.