assessmentagent
executablemacOS1.8 MBx86_64, arm64
MDM configuration manager — enforces device policies and network controls
Manages Mobile Device Management profiles and enforces organizational policies on the system. Controls network behavior through VPN and DNS proxy APIs using modern networking frameworks, and accesses Keychain for certificate and credential management. Interacts with the window server for display control and manages process lifecycle. Exposes two XPC services for inter-process communication with other system components. Communicates with 12 network endpoints, likely for policy synchronization and compliance reporting.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.8 MB
- UUID
- 3F123780-63F7-37AB-AF2D-525E4E659E52
- Analyzed
- 2026-04-09T09:42:19Z
- CDHash
- 0c11a378cf837d87464dab37c77432327e1811a7f5c138a16684f34b1528be7e
Capabilities
NetworkVPN, content filter, DNS proxy APIs
/System/Library/Frameworks/NetworkExtension.framework/Versions/A/NetworkExtensionNetworkModern networking framework (NWConnection)
/System/Library/Frameworks/Network.framework/Versions/A/NetworkSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemAccess MDM configuration profiles
com.apple.private.managedclient.configurationprofiles[object Object]SystemMDM configuration profiles
/System/Library/PrivateFrameworks/ConfigurationProfiles.framework/Versions/A/ConfigurationProfilesSystemWindow server (display control)
/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/SkyLightSystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks37
AACCoreFoundationNetworkExtensionCatalystlibbsm.0.dylibAppKitAVFoundationConfigurationProfilesMediaRemotePreferencePanesSupportSecuritySiriFoundationSkyLightlibobjc.A.dyliblibSystem.B.dylibAVRoutingCombineCoreFoundationCoreGraphicsCoreServicesNetworkRunningBoardServiceslibswiftCore.dyliblibswiftCoreFoundation.dyliblibswiftCoreImage.dylib(weak)libswiftDispatch.dyliblibswiftIOKit.dylib(weak)libswiftMetal.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dyliblibswiftQuartzCore.dylib(weak)libswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_Concurrency.dyliblibswiftos.dyliblibswiftsimd.dylib(weak)
Entitlements15
Interesting Strings
Bundle IDs(97)
File Paths(22)
/System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation/System/Library/Frameworks/AVRouting.framework/Versions/A/AVRouting/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit/System/Library/Frameworks/Combine.framework/Versions/A/Combine/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
Network Surface
Networking Frameworks
Endpoints(12)
Ipv4100.6.1.9
Hostnamefield.1.2.840.113635.100.6.1.9
Ipv40.0.0.0
Ipv60:8:16
Hostnamewww.apple.com
Hostnamemacosx26.1.internal
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
0
Network
2
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
1
System
4
Behavioral Profile
URL Endpoints
5
Telemetry Strings
0
File Paths
22
Bundle IDs
97
IOKit Constants
0
Library Functions
1
Structural HashesSHA-256
Static Libraries1 / 2700 functions identified
Identified Libraries
Functions(2700)
0x100001dc8-[AEAConcreteSandboxPrimitives enterSandboxWithError:]
0x100001f94-[AEAConcreteSandboxPrimitives .cxx_destruct]
0x100001fd8-[AEAConcreteWindowServerPrimitives addWindowsToAssessmentModeForProcessWithIdentifier:]
0x100002090-[AEAConcreteWindowServerPrimitives removeWindowsFromAssessmentModeForProcessWithIdentifier:]
0x100002148-[AEAConcreteWindowServerPrimitives removeAllWindowsFromAssessmentMode]
0x1000021c8-[AEAConcreteAuditToken initWithAuditToken:]
0x100002224+[AEAConcreteAuditToken auditTokenWithData:]
0x1000022c4+[AEAConcreteAuditToken invalidAuditToken]
0x10000230c-[AEAConcreteAuditToken processIdentifier]
0x100002338-[AEAConcreteAuditToken dataRepresentation]
0x1000023bc-[AEAConcreteAuditToken hash]
0x1000023d8-[AEAConcreteAuditToken isEqual:]
0x100002458-[AEAConcreteAuditToken underlyingToken]
0x100002470-[AEAConcreteSecurityCode bundleIdentifier]
0x1000025c8-[AEAConcreteSecurityCode isTrusted]
0x100002618sub_100002618
0x100002690-[AEAConcreteSecurityCode isEqual:]
0x100002710-[AEAConcreteSecurityCode .cxx_destruct]
0x100002754-[AEAConcreteXPCConnectionPrimitives connectionCanPublishAssessmentState:]
0x1000027a4-[AEAConcreteXPCConnectionPrimitives connectionCanRegisterAsAssessmentSource:]
Imports832 symbols from 27 dylibs
Exports1
_mh_execute_header0x0