yup, its really not that hard to break, but to break without the tool noticing is harder. they usually work in kernel extensions or use https://developer.apple

yup, its really not that hard to break, but to break without the tool noticing is harder. they usually work in kernel extensions or use https://developer.apple.com/documentation/endpointsecurity https://developer.apple.com/documentation/endpointsecurity - which gives them pretty good coverage of all the processes running, and arguments etc