systemextensionsctl

systemextensionsctl examines and manages system extensions, the user-space replacement for kernel extensions introduced in macOS Catalina. Endpoint security, network extension, and DriverKit components of EDR, DLP, VPN, and content filtering products are installed as system extensions. Any user can run systemextensionsctl list to identify installed security tooling. The uninstall, reset, and developer subcommands can remove security extensions or relax extension loading checks, but currently require System Integrity Protection (SIP) to be disabled, so they are most relevant after an attacker has disabled SIP or on hosts where SIP is already off.

Persistence Defense Impairment Discovery Impact

Path: /usr/bin/systemextensionsctl
Author: Brendan Chamberlain (@infosecB)
Created: 2026-11-07

Example Use Cases 4

Enumerate installed security products #

List all installed system extensions with their Team ID, bundle ID, version, and state. Filtering on the endpoint security and network extension categories identifies EDR agents, firewalls, VPNs, and content filters installed on the host. This command does not require root.

systemextensionsctl list
systemextensionsctl list com.apple.system_extension.endpoint_security
systemextensionsctl list com.apple.system_extension.network_extension

Discovery T1518.001 oneliner bash edr

Uninstall an EDR system extension #

Uninstall a specific system extension by Team ID and bundle ID, as returned by systemextensionsctl list. Removing an endpoint security extension stops the security product from receiving Endpoint Security events. This requires SIP to be disabled.

sudo systemextensionsctl uninstall <teamID> <bundleID>

Defense Impairment T1685 oneliner bash edr

Remove all system extensions #

Forcibly reset system extension state, removing every installed system extension and clearing related state in a single command. This requires SIP to be disabled.

sudo systemextensionsctl reset

Defense Impairment Impact T1685 oneliner bash edr

Enable system extension developer mode #

Turn on developer mode, which skips the version check performed when a new system extension is examined. This can be used to replace an installed extension with an attacker-modified build. This requires SIP to be disabled.

sudo systemextensionsctl developer on

Persistence Defense Impairment T1685 oneliner bash

Detections

Command-line detection: systemextensionsctl with uninstall, reset, or developer on arguments
Process execution detection: systemextensionsctl list executed by a script interpreter, an unsigned process, or a non-administrative user session
Correlation: systemextensionsctl uninstall or reset following a csrutil disable or csrutil status check