endpointsecurityd
executablemacOS258.3 KBx86_64, arm64
System security daemon — manages code signing, certificates, and attestation verification
Validates code signatures and manages certificate chains for system security enforcement. Accesses Keychain to retrieve and verify cryptographic credentials and code signing requirements. Submits diagnostic telemetry through Apple's unified analytics framework and communicates with multiple Apple security endpoints for attestation and certificate validation. Exposes 11 XPC services for other system processes to request signature verification, certificate lookups, and security policy decisions. Maintains direct hardware communication capabilities for security-related operations.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 258.3 KB
- UUID
- 3CADF1EC-E33B-3107-8C17-1B3AA01C7AEB
- Analyzed
- 2026-04-09T09:48:41Z
- CDHash
- 9da93d1dd9a30df86bbc8a75547a238a6b19a7157114ae6792e6782da7a6d29d
Capabilities
StoragePrivate storage area access
com.apple.private.security.storage.SystemExtensionManagement[object Object]HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks12
Interesting Strings
Bundle IDs(37)
File Paths(16)
telemetry(14)
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
1
Hardware
1
IPC
0
Analytics
1
Security
1
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
14
File Paths
16
Bundle IDs
37
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 141 functions identified
Functions(141)
0x100000f60sub_100000f60
0x10000105csub_10000105c
0x100001240sub_100001240
0x100001accsub_100001acc
0x100001be0sub_100001be0
0x100001bf0sub_100001bf0
0x100001c2csub_100001c2c
0x100001c68sub_100001c68
0x100001ca0sub_100001ca0
0x100001e78sub_100001e78
0x100002264sub_100002264
0x10000235csub_10000235c
0x100002364sub_100002364
0x10000236csub_10000236c
0x10000242csub_10000242c
0x1000024b8sub_1000024b8
0x100002544sub_100002544
0x100002550sub_100002550
0x100002770sub_100002770
0x100002970sub_100002970
Imports194 symbols from 13 dylibs
Exports1
_mh_execute_header0x0