macOS XProtect Version 5363 Adds Detection Rules and Updates Existing Checks

XProtect version 5363 expands macOS’s built-in malware detection rules, adding eight YARA rules and revising several others. The update also changes two checks related to Osascript. Apple hasn’t described which security issues or threats prompted the changes, so the rule names and version number are the available detail for assessing what’s new.

For Mac administrators and technically curious users, the practical point is that XProtect’s detection data has changed across multiple rule families. That can improve the system’s ability to recognize files or scripts that match those patterns. It doesn’t, by itself, tell users whether a particular Mac was exposed to anything, or whether a specific app or workflow will behave differently.

What changed in version 5363

The update adds eight YARA rules. Four are associated with MACOS.BRUSQUEBARNACLE: PKSNDE, SODR, UADELO and ANZSPILO. Four more are associated with MACOS.GRABBYGREMLIN: GRHA, PR, RE and GA.

It also amends rules for five other named detections: MACOS.SOMA.D, MACOS.ADLOAD.I, MACOS.BONZAIBANANA, MACOS.BRUSQUEBARNACLE.AEZLPAST and MACOS.SHADYSHOELACE.HEHEBACO. In total, the release adds eight YARA rules and changes five existing ones in that group.

A separate set of edits affects the Osascript rules in XPScripts.yr. Version 5363 adds a rule for MACOS.OSASCRIPT.BRJXEMZS and amends the rule for MACOS.OSASCRIPT.SYPR. Osascript is Apple’s scripting component; here, the source identifies changes to XProtect’s associated detection rules, but gives no further detail about the behaviors they match.

These rule names identify detection entries, not a user-facing feature set. Apple hasn’t published descriptions of the patterns or an explanation of why each rule was added or changed. It’s therefore not possible from this update notice alone to map a particular rule to a file, attack method or user-visible symptom.

How to check the installed version

The way to inspect the version depends on the macOS release. On older versions, open About This Mac, choose System Information, then look under Software and select Installations. The installation listing can show whether the XProtect update is present.

SilentKnight and SystHist can list security data file versions on systems from El Capitan through Golden Gate. Their product page is available here. SilentKnight can also be used to request installation of the update. Its label for this release is XProtectPlistConfigData_10_15-5363.

On Sequoia, Tahoe and Golden Gate, Apple distributes this update through iCloud. To check manually, open Terminal and run sudo xprotect check, then enter an administrator password when prompted. The command is intended to report the installed XProtect version. If it reports 5363 while the Mac still shows an older version, the source says users can try sudo xprotect update to request the update directly.

That command may not work in Sequoia, and the available information gives no guarantee that a manual request will succeed. A version check is useful for confirming what the system reports; it doesn’t explain why an update has not arrived or establish that every Mac will receive it on the same schedule.

What the release tells users

For most users, this is a background protection update rather than a change that calls for adjusting everyday Mac settings. The named additions and revisions show that Apple is refreshing its detection data, including checks for Osascript-related items. The notice doesn’t identify any app compatibility changes, installation size, performance impact or user action beyond checking or requesting the update.

For support teams managing multiple Macs, the main operational detail is the split between older systems and Sequoia or later. Older versions can be inspected through System Information, while newer systems have the Terminal check and update commands described above. A fleet may therefore need more than one verification procedure, depending on which macOS versions it runs.

The most useful follow-up would be clearer documentation of what the revised rules detect and how broadly version 5363 is distributed across supported systems. Until then, the concrete takeaway is limited but actionable: XProtect’s detection set has been updated, and users can verify the reported version with the method suited to their macOS release.