Apple XProtect 5367 Updates macOS Script Detection Rules

Apple’s XProtect update 5367 makes a small, targeted change to macOS malware detection: it adds one Osascript rule and revises another, while leaving the main Yara rules unchanged. Apple hasn’t shared which security issues prompted the update, so the rule changes reveal the concrete scope of the release, but not the threats or fixes behind it.

The update is intended for Macs across macOS versions. Its delivery and verification steps differ by system: Sequoia and later receive this update through iCloud, while older systems can show installed security data in System Information. Users who need to check or request installation also have command-line options, though the source cautions that a manual update may not work on Sequoia.

What changed in version 5367

XProtect’s main Yara rules have no changes in this version. The edits are in the Osascript rules stored in XPScripts.yr: one new rule, MACOS.OSASCRIPT.ANJXLOOC, and a change to the existing MACOS.ANGRYORB.JXDR rule.

That distinction matters when interpreting the update. The release changes a specific part of XProtect’s detection data rather than revising its main Yara rules. The available details don’t describe what either named rule detects, what conditions changed in the revised rule, or whether the addition responds to a newly observed threat. Those points shouldn’t be inferred from the rule names alone.

Yara rules are a way to describe patterns that software can check for, while the update’s Osascript rules concern a particular category of script. In practical terms, a rule addition or revision changes the detection information available to XProtect. It doesn’t, by itself, tell users what files or activity will trigger a match, or whether they’ll notice any visible change in normal Mac use.

Checking installation on older macOS versions

On older macOS systems, the installation history can be checked in System Information. Open About This Mac, launch System Information, then select Installations under Software. The listing can help establish whether the security data update has arrived without relying on a notification.

For a broader view of security data file versions, SilentKnight and SystHist provide listings for systems from El Capitan to Golden Gate. Their information is available from the product page. This can be useful when comparing the version shown on a Mac with the version expected for its system.

If the update hasn’t appeared, the article describes two ways to request it: use SilentKnight or run a command at the command line. In SilentKnight, the update’s label is XProtectPlistConfigData_10_15-5367. That exact identifier gives users a way to select the named update rather than guessing which security data item corresponds to version 5367.

Manual checks on Sequoia and later

Apple has already distributed version 5367 to Sequoia and later through iCloud. To check the installed version manually, open Terminal and run:

sudo xprotect check

The command requests administrator authentication, so enter the Mac’s administrator password when prompted. If the result reports version 5367 while the Mac still shows an older installed version, the documented follow-up command is:

sudo xprotect update

The source makes no guarantee that this second command will work on Sequoia. Treat the check as a way to inspect the reported XProtect version, and the update command as an available request rather than a guaranteed repair. If the reported version remains unclear after running it, the source doesn’t specify another troubleshooting procedure.

What users can conclude

For most users, version 5367 is a quiet security data change: one Osascript rule has been added, another has been adjusted, and the main Yara rules are unchanged. Apple hasn’t published enough detail to assess the underlying threat coverage or the significance of the modification to the existing rule.

Users can still verify whether the version is installed using the method suited to their macOS release. The practical takeaway is to check the recorded version before trying to force an update, especially on Sequoia, where the manual command’s result is explicitly uncertain. Future detail about the rules or their detection scope would clarify what changed beyond the update record.