The edge cases and qualifiers you provide here are very far from my needs. Most executables I want to mute are well protected by SIP, and will never move (MacOS private frameworks, daemons etc. plus few third-party that are also very well defined). My issue is very blunt. I mute a simple and perfect executable path. Here are some - my list is much longer, but you'll get the idea: +(NSSet *) baseBinaryPathWhitelist { static NSSet *_baseBinaryPath = nil; // any executable in these specific paths will be ignored static dispatch_once_t onceToken; dispatch_once(&onceToken, ^{ _baseBinaryPath = [NSSet setWithArray: @[ NSProcessInfo.processInfo.arguments[0], // don't inspect our own ITProtector process. @/sbin/launchd, @/bin/launchctl, @/bin/ps, @/bin/sleep, @/usr/bin/dscl, @/usr/bin/log, @/usr/bin/vmmap, @/usr/sbin/syslogd, @/usr/sbin/spindump, @/usr/sbin/usernoted, @/usr/sbin/securityd, @/usr/sbin/ipconfig, @/usr/libexec/biomesyncd, @/usr/libexec/logd]; But when I use the newer API (that you say is identical t