On Apple's website, the company makes this claim about macOS High Sierra's security features:

macOS' malware detection

Can anyone give me more details on the technology that enables macOS to determine if a file downloaded with Safari is a malware ? I'm just curious to see how it compares with an antivirus (no need to start a discussion about why you need or don't need an antivirus on Mac or in general, please not for the 10000th time).


It's part of the XProtect / file quarantine scheme built into the OS. macOS has a hard-coded list of file signatures in /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist. If a file matches one of the signatures, it gets flagged and quarantined. The list is silently updated, outside the usual software-update mechanism.

It is effectively a very rudimentary blacklist of known malware. XProtect does not provide active scanning or heuristic-based protection offered by typical antivirus products.

  • Thanks for your answer ! So if a file is downloaded on the computer through a drive-by attack via a script on a website for example, XProtect won't catch it as it only scans files downloaded voluntarily by the user ? – MFJC Oct 3 '17 at 9:54
  • AFAIK it tracks this by source application. If the executable code came through a quarantine-able app (for example, a browser like Safari), whether through user action or drive-by automatic download, the resulting download is flagged. You'll typically see a warning dialog "<AppName> is an application downloaded from the Internet" if it doesn't match an XProtect entry, and something like "we blocked this from running" dialog if it did match. – vykor Oct 4 '17 at 1:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .