Where Does macOS Store XProtect Definitions?
macOS keeps XProtect malware definitions in a system bundle, refreshed silently in the background.
Last updated
XProtect is the Mac's built-in malware scanner, and its brain is a definitions bundle in the system Library. Apple refreshes it in the background without App Store updates or restarts.
The bundle path moved in Big Sur from the old System location to the Apple system Library, which is why older guides point somewhere that no longer exists. A sibling Remediator component handles removal of what definitions detect. Neither is user-serviceable; both update themselves.
Where macOS stores this, by platform
/Library/Apple/System/Library/CoreServices/XProtect.bundle
Malware definitions bundle (macOS 11 and later). Older guides cite the pre-Big Sur System path, which no longer updates. Definitions refresh via background security updates.
Frequently asked questions
How do I update XProtect manually?
Nothing. Definitions arrive through background security updates with no user action. Checking the bundle version only confirms what already updated itself.
Notice an outdated path? Let us know.