An unfamiliar process in Activity Monitor is usually harmless: macOS has hundreds of background services. These steps help you judge. They do not prove a Mac is clean or infected.

1. Find the process

Open Activity Monitor and sort by % CPU or Memory. Double-click a process and choose Open Files and Ports to see what it’s using, or Sample to see what it is doing.

2. Find where it lives

In Terminal, find the file behind a process ID:

ps -p <pid> -o comm=

Processes run from /System or /usr are part of macOS. Ones running from /tmp, your Downloads folder or a hidden folder deserve a closer look.

3. Check its signature

codesign -dv --verbose=4 /path/to/binary

A valid signature from a developer you recognise is reassuring. An unsigned binary or an unfamiliar developer is not proof of a problem, but it is worth investigating.

4. Check what it is connecting to

lsof -i -P | grep LISTEN

This lists processes listening on network ports. Look for services you don’t recognise.

System Settings → General → Login Items & Extensions lists what launches automatically. Remove anything you don’t remember installing.

Use a real security tool for a verdict

Manual checks are only clues. For an actual opinion, use dedicated tools: Objective-See’s free KnockKnock, BlockBlock and LuLu, or a scanner such as Malwarebytes. Apple’s built-in protections (Gatekeeper, XProtect and notarisation) also do real work, so keep macOS updated.

What Gardner does here

Gardner’s Watch line points out processes that might be worth a look, such as a program named like a macOS component that isn’t Apple-signed, or one whose code signature doesn’t match its file. It is advice only: Watch findings never have an action button, Gardner never ends a process on its own, and it does not claim to detect malware. When it flags something, use the steps above or a tool built for the job.

How to check whether a process on your Mac looks suspicious