There are two broad categories of core processes. Processes that initialize system environment and those that initialize the user environment. Whatever is the category, you need to know them well in order to detect abnormal things.
Main Processes
There are several core process that are important to examine since malware often drool π€€ over them. Singleton - one instance running only. If any of these having more than 1 process should be the object of further investigation.
The process tree
- BootROM
- POST - Power On Self Test, if all’s ok with hardware - beep.
- EFI - Extensible Firmware Interface, choose bootable partition and OS.
- Boot Loader. Either boot.efi or BootX.
System/Library/CoreServices/Boot.efi
- Apple logoβ on the screen. Load kext files (kernel extensions) into RAM from/System/Library/Caches/com.apple.kext.caches/Startup/kernelcache
. If this cache is damaged,/System/Library/Extensions
is used, each driver enumerated to determine if it’s needed for booting. If FV is enabled, enter password first.- Kernel.
mach_init
. Kernel initialization - Additional drivers, core BSD Unix system, I/O Kit. Dark gray spinning gear right below the Apple logo. Find the root device - Mount system partition as root.- Launchd.
/sbin/launchd
. System Initialization - The login window or the userβs desktop background if the auto login is enabled. The first non-kernel root process.- loginwindow
- SystemStarter
- user launchd
- Launchd.
- Kernel.
Main files: mkextcache, launchd, loginwindow, /System/Library/CoreServices.
launchd
Parent π€±: kernel
Children π§ :
Singleton βοΈ: Yes
Path to file π£: /sbin/launchd
Account:
Start time: Boot
PID 1. The first daemon launched. Started up by kernel. Spawns other demons and processes.
WindowServer TouchBarServer
kernel_task UserEventAgent Wi-Fi bluetoothd gamecontrollerd UIKitSystem routined locationd
opendirectoryd launchd cfprefsd - not singleton PerfPowerServices Dock runningboardd analyticsd sysmond powerd Control Centre logd ContextStoreAgent fseventsd sharingd mds airportd launchservicesd iconservicesagent mds_stores corebrightnessd com.apple.WebKit.WebContent contextstored mdworker_shared
Quick Check List
Singletons vs Cloners
Singletons:
Cloners:
Boot vs Varies
Boot:
Varies:
System32 vs Other
System32:
Other: