Apple XProtect 5362 Adds 21 Detection Rules Across macOS

Apple’s XProtect update 5362 changes a broad set of Mac malware detections, adding rules for named malware families and AppleScript activity. The update reached Macs overnight and is available across macOS versions, with delivery and installation checks differing on newer systems. Apple hasn’t published details about the issues it addresses, so the rule changes show what detection coverage changed without explaining the threat activity behind them.

XProtect is macOS’s built-in malware detection system. Its YARA rules describe patterns that can help identify files associated with known threats. Adding or revising a rule can change what the system recognizes; removing one changes the set of patterns it checks. The version number alone doesn’t reveal how a rule behaves, what files it matches, or whether a particular Mac encountered anything it targets.

What changed in version 5362

The update adds 15 YARA rules across several named families: ADLOAD, ANGRYORB, BOATLOAD, BRUSQUEBARNACLE, CONFUSEDCABAL, REGRESSIVESALMON and SHADYSHOELACE. The additions cover individual variants identified in the release listing, including MACOS.ADLOAD.FOST; MACOS.BOATLOAD.GAPRDO; and multiple CONFUSEDCABAL entries, such as CHBRIMA, PIAIPRA and RERSKEA.

There are also new entries for MACOS.ANGRYORB.KECO and MACOS.ANGRYORB.LOITHE, plus MACOS.BRUSQUEBARNACLE.AEZLPAST and MACOS.REGRESSIVESALMON.B6OSST. SHADYSHOELACE gains rules for HEHEBACO, PAAUSE and PAKEUN. Apple’s update also removes the rule MACOS.ADLOAD.FMT and amends the existing rules MACOS.SHADYSHOELACE.LOADCO, MACOS.ANGRYORB.RUC2FO and MACOS.ANGRYORB.RUCOX8.

That mix of additions, edits and a removal is more informative than a version bump alone, but it still leaves important questions open. The listing doesn’t say why the ADLOAD.FMT rule was removed, what changed in the amended rules, or whether those edits reflect newly observed files or a change in how XProtect identifies them. Without technical notes from Apple, conclusions about the specific threats or the urgency of each change would be guesswork.

AppleScript detections and an unclear entry

XProtect’s Osascript rules also change in this release. The listing says six new rules were added for MACOS.OSASCRIPT.COTA, RELABYSH, REETRE, COIMA, COLOA and SYPR. It also says the rule for MACOS.OSASCRIPT.SHLAMAA was amended.

There’s an apparent inconsistency in the same account: it lists SYPR among the additions, then says the MACOS.OSASCRIPT.SYPR rule was removed. The available description doesn’t clarify whether one of those entries is a mistake or whether separate rules are involved. That makes the Osascript change list harder to interpret until a corrected or more detailed listing becomes available.

Osascript is the macOS command-line tool for running AppleScript and JavaScript for Automation scripts. A detection category for Osascript activity points to rules associated with that scripting mechanism; it doesn’t establish that ordinary scripts are affected or explain what behavior any individual rule detects. For developers and administrators, the practical takeaway is that XProtect’s coverage changed in this area, while the precise matching conditions remain unpublished.

Checking the installed version

On older macOS versions, the installation record can be checked in System Information. Open About This Mac, choose System Report if needed, then select Installations under Software and look for the XProtect data entry. SilentKnight and SystHist can also show security data file versions for systems from El Capitan through Golden Gate. SilentKnight’s product page has more information about both tools: Eclectic Light’s product page.

If the update hasn’t appeared, the source describes SilentKnight and a command-line method as options for prompting installation. In SilentKnight, the named update is XProtectPlistConfigData_10_15-5362. The tool can be useful when an administrator needs to check or request a specific data file, though the listing doesn’t give timing guarantees or describe how installation behaves on every Mac.

Checking newer systems through Terminal

On Sequoia and later, including Tahoe and Golden Gate, Apple distributes this update through iCloud. To check the version manually, open Terminal and run:

sudo xprotect check

Enter the administrator password when prompted. If the command reports version 5362 while macOS still shows an older installed version, the source says the update can be requested with:

sudo xprotect update

The command is also reported to work on Golden Gate. As with any update check, confirm the reported version after running it rather than treating the command’s completion as proof that the new data was installed.

For Mac users, 5362 is a substantial detection update by the number of rules it adds and revises, but Apple’s silence on the underlying threats limits what can be inferred from the names alone. The useful next step is to confirm the installed version; clearer technical notes would help explain the amended rules and resolve the SYPR discrepancy.