How to Check if your Mac Malware Definitions List is Updated

The malware protecting Mac OS X Security Update will automatically download and update it’s malware definitions list from Apple, but if you’re like me you probably want to know how to manually check if the malware list is updated or not.

We’ll show you where the malware list is located on Mac, and how to determine when it was last updated, and if you want to, we’ll additionally show how to forcibly update the malware definition file on Mac so that everything is up to date as it should be.

By the way, the malware definition list is commonly referred to as “Xprotect” and it is one of a variety of major security features in Mac OS aimed at preventing malware, along with Gatekeeper and MRT.

How to Check When the Mac Malware Definitions List was Last Updated

You’ll need to use the command line for this, but it’s otherwise a pretty simple procedure:

1. Launch the Terminal (/Applications/Utilities/)
2. Paste in the following command

For MacOS Catalina and Mojave:

system_profiler SPInstallHistoryDataType | grep -A 5 "XProtectPlistConfigData" |grep "Date"

For MacOS Sierra and earlier

cat /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

3. Look at the most recent date entry shown in the returned results

The date listed shows when the file was last modified, and the integer tag shows you which version the definitions list is. Assuming you haven’t disabled the anti-malware automatic updates (not recommended) and you are connected to the internet, this list should update on it’s own from Apple every day.

Note for modern macOS versions, you’ll be able to see the Xprotect data through system_profiler, whereas earlier versions are easiest to refer directly to the plist for Xprotect.

Depending on the version of Mac OS X, you may find that sometimes the XProtect malware listing document is located at the following location instead:

/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist

The location is the same, the file name is slightly different (XProtect.plist vs XProtect.meta.plist).

How to Force the Malware Definitions List to Update in Mac OS X

If your malware definitions are outdated, or you are managing the updates yourself, you can force the list to download the newest version from Apple by doing the following:

1. Launch System Preferences and click on the “Security” panel
2. Click on the unlock icon in the bottom corner, enter your Administrator password to make changes
3. Under the “General” tab, click to uncheck and then recheck the box next to “Automatically update safe downloads list”

The list should now update from Apple, you can verify you have the most up to date version by using the command line again as shown above.

This is a great tip, heads up to amarold, although they chose to use the ‘more’ command and I went with ‘cat’ mostly because it is shorter.