UserEventAgent

executablemacOS174.6 KBx86_64, arm64

System daemon — manages privileged network operations and process state queries

Runs as a system daemon with privileged network access and the ability to query process state from RunningBoard. Exposes two XPC services for inter-process communication with other system components. Maintains a private storage area for daemon-specific data and communicates with multiple network endpoints. Handles telemetry reporting and references numerous bundle identifiers, suggesting integration with several macOS subsystems.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 174.6 KB
UUID: 953BBEF1-2F2F-34BC-AF27-32EA3E095287
Analyzed: 2026-04-09T09:40:38Z
CDHash: f6a613bc821e89edb0d8bc6235ed461af09447373ff44ef09b976d008fb7da4c

Capabilities

NetworkPrivileged network daemon access

com.apple.networkd_privileged [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.os_eligibility.readonly [object Object]

IpcQuery process state from RunningBoard

com.apple.runningboard.process-state [object Object]

Frameworks6

CoreTelephony(weak)CoreGraphics(weak)Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements27

com.apple.CommCenter.fine-grained

com.apple.coreduetd.allowtrue

com.apple.coreduetd.contexttrue

com.apple.diagnosticpipeline.requesttrue

com.apple.duet.activityscheduler.allowtrue

com.apple.hid.transport.user-accesstrue

com.apple.iokit.wakerequesttrue

com.apple.locationd.statustrue

com.apple.networkd_privilegedtrue

com.apple.private.AuthorizationServices

system.services.systemconfiguration.network

com.apple.private.ReportSystemMemorytrue

com.apple.private.externalaccessory.showallaccessoriestrue

com.apple.private.findmymacd.spitrue

com.apple.private.ioaccelmemoryinfotrue

com.apple.private.kernel.get-kext-infotrue

com.apple.private.nehelper.privilegedtrue

com.apple.private.security.storage.os_eligibility.readonlytrue

com.apple.private.sharing.unlock-managertrue

com.apple.private.tcc.allow

kTCCServiceListenEvent

com.apple.private.vfs.allow-low-space-writestrue

com.apple.private.xpc.launchd.event-monitortrue

com.apple.rapport.Clienttrue

com.apple.rootless.storage.lockoutagenttrue

com.apple.runningboard.process-statetrue

com.apple.sysmond.clienttrue

com.apple.systemstatus.domains

com.apple.wifi.eventstrue

Interesting Strings

Bundle IDs(60)

com.apple.private.findmymacd.spi !com.apple.CommCenter.fine-grained0 #com.apple.hid.transport.user-access #com.apple.private.ioaccelmemoryinfo $com.apple.diagnosticpipeline.request

File Paths(6)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics /System/Library/Frameworks/CoreTelephony.framework/Versions/A/CoreTelephony /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation Library/Apple/System/Library/UserEventPlugins

telemetry(1)

_os_variant_has_internal_diagnostics

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(6)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

1

Storage

1

Hardware

0

IPC

1

Analytics

0

Security

0

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

1

File Paths

6

Bundle IDs

60

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codee72b2d0268f2179ed9f7ece2a7b233e398df8c981c95f11340b4d06b11c2464b

Imports422f10f605b9448149efe791ce65251ef2385b7dea709c8c58ce3c764759ea6e

Frameworks7467991eaae6429e8f004f9b085b9f504902eb247f5a4ae03f0bfc85521cc0e4

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlementsd6bd553aa1755858bc9f7f4cc6956e218008cf1fb4731746e2bdcb18c4df29f9

Symbols422f10f605b9448149efe791ce65251ef2385b7dea709c8c58ce3c764759ea6e

Static Libraries0 / 51 functions identified

Functions(51)

0x100000ad8sub_100000ad8

0x100001088sub_100001088

0x100001a8cxpc_event_module_get_queue

0x100001a94xpc_event_module_get_aslclient

0x100001ad8sub_100001ad8

0x100001c00sub_100001c00

0x100001c28sub_100001c28

0x100001c58sub_100001c58

0x100001cdcsub_100001cdc

0x100001ed8sub_100001ed8

0x100001f3csub_100001f3c

0x100001f9csub_100001f9c

0x100001facsub_100001fac

0x100001fccsub_100001fcc

0x100001fecsub_100001fec

0x100002144sub_100002144

0x1000021ccxpc_event_provider_create

0x100002478xpc_event_provider_get_queue

0x100002480xpc_event_provider_token_set_state

0x1000024e8xpc_event_provider_token_fire_with_reply

Imports118 symbols from 6 dylibs

libSystem.B.dylib94 CoreFoundation17 libobjc.A.dylib4 CoreTelephony1 CoreGraphics1

Exports11

UserEventAgentFireEvent0x292c

UserEventAgentRegisterForLaunchEvents0x27cc

UserEventAgentSetLaunchEventState0x28d8

_mh_execute_header0x0

xpc_event_module_get_aslclient0x1a94

xpc_event_module_get_queue0x1a8c

xpc_event_provider_create0x21cc

xpc_event_provider_get_queue0x2478

xpc_event_provider_token_fire0x257c

xpc_event_provider_token_fire_with_reply0x24e8

xpc_event_provider_token_set_state0x2480

Similar Binaries1,470 comparable

remotecompositorclientd

corebrightnessd

NANDTaskScheduler

KernelEventAgent

xpcroleaccountd