Bypass Record
Exploitation for Priv-Esc × Trellix Agent for macOS
A publicly-reported instance of Exploitation for Priv-Esc bypassing Trellix Agent for macOS, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Uncontrolled search path element (CWE-427) in Trellix Agent for macOS. A local attacker can place a malicious file in /Library/Trellix/Agent/bin/. When the TA deployment feature is triggered, the agent executes the file, leading to command injection and potential full system compromise.
Detection & mitigation
Monitor file creation events in /Library/Trellix/Agent/bin/ for unexpected or unsigned binaries, and enforce strict permissions on that directory to prevent unauthorized writes. Ensure Trellix Agent is updated to version 5.7.9 or later to remediate the vulnerability.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.