Brandon7CC

/*
    Author: Brandon Dalton (Red Canary Threat Research)
    Date: 2023-12-07
    Summary: This script enumerates the event subscriptions requested by an arbitrary client
             by hooking the `es_subscribe` function.
    
    Target: Any arbitrary ES client like an EDR sensor's System Extension
    Usage: `sudo frida -p $(TARGET_CLIENT) -l event_subscription_interceptor.js`
*/

Brandon7CC

/*
    Author: Brandon Dalton (Red Canary Threat Research)
    Date: 2023-12-07
    Summary: This script attempts to instrument the `sendEvent:event:` method of the ESCoreAnalytics class.
      - Download this script
      - Target: You're targeting `endpointsecurityd`, so grab its PID: `sudo launchctl list | grep endpointsecurityd`
      - To run: `sudo frida -p $PID -l es_coreanalytics_event_subs.js`
*/

const eventTypeMapping = {