Apple

griddatad #

 full_path = "/usr/libexec/griddatad"

GSSCred #

 full_path = "/System/Library/Frameworks/GSS.framework/Helpers/GSSCred"
 runs_as = "root"

healthd #

 full_path = "/System/Library/Frameworks/HealthKit.framework/healthd"
 runs_as = "mobile"

The binary is a part of HealthKit private framework

homed #

 full_path = "/System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed"
 runs_as = "mobile"

homed is a daemon that manages home state and controls HomeKit accessories.

The binary is a part of HomeKitDaemon private framework.

iconservicesagent #

 full_path = "/System/Library/CoreServices/iconservicesagent"
 runs_as = "mobile"

Daemon managing icons

identityservicesd #

 full_path = "/System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app/identityservicesd"
 runs_as = "mobile"

identityservicesd is a daemon in iOS that handles user account credentials on the device like iCloud, iMessage, App Store, FaceTime, etc. This allows user to automatically sign in to various accounts without needing to enter the account credentials. But, this process requires Keychain password to access the passwords stored in Keychain. If it doesn’t get the keychain password, it will ask for it with the identityservicesd wants to use the login keychain prompt.

...

imagent

Apple

imagent #

 full_path = "/System/Library/PrivateFrameworks/IMCore.framework/imagent.app/imagent"
 runs_as = "mobile"

IMAgent is a process that listens for FaceTime/iMessage invitations. It will be active even if FaceTime isn’t running.

IMDPersistenceAgent

Apple

IMDPersistenceAgent #

 full_path = "/System/Library/PrivateFrameworks/IMDPersistence.framework/XPCServices/IMDPersistenceAgent.xpc/IMDPersistenceAgent"
 runs_as = "mobile"

ind

Apple

ind #

 full_path = "/System/Library/PrivateFrameworks/iCloudNotification.framework/ind"
 runs_as = "mobile"

installcoordinationd

Apple

installcoordinationd #

 full_path = "/System/Library/PrivateFrameworks/InstallCoordination.framework/Support/installcoordinationd"
 runs_as = "mobile"

The binary is a part of InstallCoordination private framework.