auditd

executablemacOS136.1 KBx86_64, arm64

Hardware diagnostics and telemetry daemon — monitors device health and submits analytics

Communicates directly with hardware and drivers to collect system diagnostics and health metrics. Submits collected data to Apple's unified analytics infrastructure via network endpoints. Maintains private storage for diagnostic data and logs. Exposes an XPC service for other system components to request diagnostics or health status. Runs continuously as a system daemon to monitor device state and performance.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 136.1 KB
UUID: 24AC0A51-09CC-370C-9CEF-64516689DAED
Analyzed: 2026-04-07T05:21:12Z
CDHash: 4869f6b29e27c9b86ff177c8ccfaea5b6291a88e8ca9744f60f3c39ada334b2f

Capabilities

StoragePrivate storage area access

com.apple.private.security.storage.auditd [object Object]

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

Frameworks5

CoreAnalytics IOKit libbsm.0.dylib libauditd.0.dylib libSystem.B.dylib

Entitlements2

com.apple.private.protected-audit-controltrue

com.apple.private.security.storage.auditdtrue

Interesting Strings

Bundle IDs(9)

)com.apple.private.protected-audit-control )com.apple.private.security.storage.auditd <key>com.apple.private.protected-audit-control</key><key>com.apple.private.security.storage.auditd</key>com.apple.audit.change

File Paths(5)

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics /var/audit/audit_quick_start_error.log /var/audit/current /var/run/auditd.pid

telemetry(2)

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics _analytics_send_event

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Endpoints(6)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

1

Hardware

1

IPC

0

Analytics

1

Security

0

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

2

File Paths

5

Bundle IDs

9

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code42e1941c153830dc54004e32821697318ac89254753975b206ecf78ae4ac2a46

Importsf4452e81a52ae70bc3d83b6d0b37033a9eb6af28aeea042137429f82ccfcd388

Frameworksc277d71d3c831c103af0920fe3a4401522f437098c1938d598be3ee650bc1d98

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements3d59ef8bd6ac096c782bac711f3a7a26e7445b4abf1c872423e490311f746bba

Symbolsf4452e81a52ae70bc3d83b6d0b37033a9eb6af28aeea042137429f82ccfcd388

Static Libraries0 / 52 functions identified

Functions(52)

0x100000710sub_100000710

0x1000007a0sub_1000007a0

0x100000888sub_100000888

0x100000918sub_100000918

0x1000009a8sub_1000009a8

0x100000a38sub_100000a38

0x100000ac8sub_100000ac8

0x100000b58sub_100000b58

0x100000be8sub_100000be8

0x100000c78sub_100000c78

0x100000d08sub_100000d08

0x100000d98sub_100000d98

0x100000e28sub_100000e28

0x100000eb8sub_100000eb8

0x100000f9csub_100000f9c

0x100000fa8sub_100000fa8

0x100000fecsub_100000fec

0x100001040sub_100001040

0x100001094sub_100001094

0x1000010e8sub_1000010e8

Imports90 symbols from 5 dylibs

libSystem.B.dylib65 libauditd.0.dylib14 IOKit6 libbsm.0.dylib4 CoreAnalytics1

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

fairplaydeviceidentityd

InternetSharing

applessdstatistics