How can I figure out what program is starting and quitting?

Solution 1:

Well the obvious solution is to temporarily disable SIP and run execsnoop as you’ve yourself identified.

There is a cruder and less reliable way which doesn’t require SIP disabled. The next time you see this happen, quickly go into Terminal and run

$ log show —-last 1m —-info —-debug —-predicate='sender contains "launchservicesd"' 

That will show you the last 1 minute of breadcrumbs from Launch Services, through which it is likely that your mystery process is being invoked. If it’s not, you won’t see it there. Look for (and/or grep) lines containing CHECKIN and DEATH.