Apple XProtect 5368 Adds Nine Yara Rules as Remediator Moves to Version 170

Apple’s latest XProtect update changes the detection rules shipped to Macs, while its companion XProtect Remediator update removes a scanner. XProtect reaches version 5368, and Remediator reaches version 170. The practical details are unusually narrow: Apple hasn’t described the security issues behind the changes, and the XProtect app still can’t be run manually by double-clicking it or through XProCheck.

For Mac administrators and technically minded users, the useful news is in the rule and scanner changes. The version numbers confirm which security data is installed, but they don’t reveal what prompted each detection update or whether a particular Mac has encountered a matching file. That leaves the update record as a way to track changes, not a guide to the underlying threats.

What changed in XProtect

XProtect 5368 adds nine Yara rules. Their identifiers are MACOS.CHEEKYCOBRA.COSYA, MACOS.CHEEKYCOBRA.PE, MACOS.FLUSTEREDFLAMINGO.STA, MACOS.FLUSTEREDFLAMINGO.UNA, MACOS.FLUSTEREDFLAMINGO.BAA, MACOS.FLUSTEREDFLAMINGO.OPPAA, MACOS.SHADYSHOELACE.CUOSPACO, MACOS.TIMELYTURTLE.MOA and MACOS.TIMELYTURTLE.SWA. Apple also removes the rule named MACOS.DUBROBBER.CHBI.

Those names identify individual detection rules in XProtect’s data. Adding a rule expands or changes what the detection system can recognize; removing one means that rule is no longer part of this version’s set. The names alone don’t establish what files the rules match, how common those files are, or why Apple changed its coverage. Apple hasn’t published that explanation with this update.

The Osascript rules also change in XPScripts.yr. One new rule, MACOS.OSASCRIPT.SHCUPA, is added, and the rules MACOS.OSASCRIPT.COTABR, MACOS.OSASCRIPT.COTAAP and MACOS.OSASCRIPT.SYPR are amended. Taken together, these edits show that the update affects several detection categories rather than only adding a single new signature. The available details don’t say what changed inside the amended rules, so it’s not possible to infer their precise effect from the identifiers.

Remediator drops DubRobber scanner

XProtect Remediator 170 removes the DubRobber scanner. The source gives no reason for its removal, so the change shouldn’t be read as proof that a threat has disappeared or that affected Macs no longer need attention. It records a change to the set of scanners included in Remediator, while leaving the motivation open.

There are no reported changes to the Bastion rules used by XProtect’s behavioural detection. That gives a useful boundary to the update: the reported edits concern XProtect’s named rules and the Remediator scanner set, while Bastion’s behavioural rules are unchanged. The details don’t describe how those components interact during a detection, so they don’t support a broader claim about the update’s effect on protection.

A notable usability limitation remains. The XProtect app still won’t run manually, whether launched by double-clicking or checked in XProCheck. That makes a direct, user initiated inspection through those routes unavailable. Version checks and update status are still possible through other system tools, but they answer a narrower question: whether the security data is present, rather than what it would detect in a specific case.

Checking versions and installing the update

On older macOS versions, users can check installed security data through System Information. Open About This Mac, go to Software, then select Installations. This provides a record of installed items and helps distinguish a completed update from one that hasn’t yet arrived.

SilentKnight and SystHist list security data file versions for systems from El Capitan through Golden Gate. Their product page is linked here. The update labels used in SilentKnight are XProtectPlistConfigData_10_15-5368 and XProtectPayloads_10_15-170. The source also says users can prompt installation with SilentKnight or from the command line if a Mac hasn’t installed the updates.

On Sequoia, Tahoe and Golden Gate, this XProtect update has already been distributed through iCloud. To check manually, run sudo xprotect check in Terminal and enter an administrator password when prompted. If the command reports version 5368 while macOS still shows an older installed version, sudo xprotect update can be used to request the update. The source cautions that this may not work on Sequoia, so the command isn’t a guaranteed fix.

What the update record can tell you

For now, the clearest takeaway is a set of concrete maintenance changes: nine new Yara rules, one removed Yara rule, four Osascript rule edits, and the removal of the DubRobber scanner. Version checks can confirm whether a Mac has received the files, while Apple’s lack of detail limits what users can conclude about the specific security situations addressed. The next useful signal would be a clearer account of what the changed rules cover, or a way to inspect XProtect’s activity directly.