macOS Weaknesses Chained to Silently Disable Endpoint Security Agents

An attack can be carried out using a standard non-admin account to exploit legitimate macOS behavior. This exploit does not rely on software vulnerabilities, but rather utilizes the operating system's existing behavior to achieve its goals. The attack allows for the silent disabling of endpoint security agents.