Exploring FSKit: Writing Filesystems for Fun, profit, & Def, Detections & Evasion?

The talk looks at FSKit, Apple's framework for writing filesystems in userspace, and places it in the history of userspace filesystems on macOS. The speaker traces this from MacFUSE and SSHFS to older experimental filesystems that exposed system internals as files. The argument is that moving components out of the kernel improves stability and reduces attack surface.

Next, the speaker inspects how FSKit is wired together on a current macOS build, covering the extension processes, the helper daemon and the mount path through disk arbitration. They then walk through building a small pseudo filesystem: a container with a resource, a volume with capabilities set in the Info.plist, and the probe, load and unload hooks. Enabling a module requires user approval, and parts of the API were still sparsely documented at the time.

The practical application is canary files. Sensitive paths such as SSH keys, cloud tokens and keychains are watched alongside decoy files backed by FSKit, and Endpoint Security events raise alerts when those paths are touched. The speaker describes a deployment across thousands of Macs for a client that had undergone a penetration test. The main takeaway is to combine Endpoint Security muting, file access monitoring and FSKit to bait and catch infostealers.