GetFileInfo
Uses the CommandLine/Terminal to return type, creator, attributes, created, and modified file information of a file or directory.
Categories: discovery
View authoritative reference ↗🍎 CRAWLABLE DATASET INDEX
LOOBins
macOS binaries with documented use cases, tactics, paths, and detection references.
Review the documented use case together with process lineage, arguments, paths, signer information, and other macOS telemetry before classifying activity.
62 searchable binaries. Open the interactive explorer →
SetFile
Uses the CommandLine/Terminal to set file and or directory attributes. It can set attributes, creator, creation date, modification date, and file type for multiple files at a time.
Categories: persistence, defense evasion
View authoritative reference ↗caffeinate
caffeinate creates assertions to alter system sleep behavior. If no assertion flags are specified, caffeinate creates an assertion to prevent idle sleep. If a utility is specified, caffeinate creates the assertions on the utility's behalf, and those assertions will persist for the duration of the utility's execution. Otherwise, caffeinate creates the assertions directly, and those assertions will persist until caffeinate exits.
Categories: execution, defense evasion
View authoritative reference ↗chflags
The chflags utility modifies the file flags of the listed files as specified by the flags operand.
Categories: defense evasion
View authoritative reference ↗codesign
The codesign command is used to create, check, and display code signatures, as well as inquire into the dynamic status of signed code in the system.
Categories: defense evasion
View authoritative reference ↗csrutil
Used to enable/disable SIP, configure netboot and authenticated-root settings
Categories: defense evasion, reconnaissance, discovery
View authoritative reference ↗defaults
The defaults binary is normally used to interact with the user defaults system, a database of macOS used to manage system settings much like the Windows Registry. The database can be abused by threat actors to change settings in attempt to evade defenses or to gain persistence.
Categories: defense evasion, discovery, persistence
View authoritative reference ↗disown
disown is a system utility that can be utilized to persist a shell process after a terminal has been closed or a shell session has been terminated. This is accomplished by preventing a SIGHUP from being sent to the running job, and removing the process from the shell jobs table. Unlike nohup which is used during process initialization, disown can be used to modify an existing process.
Categories: persistence
View authoritative reference ↗ditto
ditto is a command line utility that is commonly used to copy files and directories while preserving file attributes and permissions. The tool can be used by malicious actors to collect and exfiltrate sensitive data, move laterally, and/or perform DLL hijacking or binary replacement attacks.
Categories: collection, exfiltration, lateral movement, defense evasion, persistence
View authoritative reference ↗dns-sd
dns-sd can be used to interact with the Multicast DNS (mDNS) and DNS Service Discovery (DNS-SD) protocols. The tool is useful for administrators but can also be abused by malicious actors to discover local network services.
Categories: discovery
View authoritative reference ↗dscacheutil
dscacheutil does various operations against the Directory Service cache including gathering statistics, initiating lookups, inspection, cache flush, etc. This tool replaces most of the functionality of the lookupd tool previously available in the OS.
Categories: discovery
View authoritative reference ↗dscl
An extensive tool for communicating with the Directory Services, useful for Discovery.
Categories: discovery, persistence
View authoritative reference ↗dsconfigad
This tool allows command-line configuration of the Active Directory Plug-in. dsconfigad has the same functionality for configuring the Active Directory plugin as the Directory Utility application. It requires "admin" privileges to the local workstation and to the Directory to make changes.
Categories: discovery
View authoritative reference ↗dsexport
dsexport is a command-line utility designed to export records from the directory services database on a local host or from a connected LDAP service. The tool can be used to gather information about users, groups, and computers. The tool can also be used to export the directory services database to a file for offline analysis.
Categories: reconnaissance, discovery
View authoritative reference ↗funzip
funzip is a macOS utility that extracts a ZIP or gzip file directly to output from archives or other piped input. The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.
Categories: execution
View authoritative reference ↗hdiutil
hdiutil manipulates disk images such as DMG and ISO files. You can mount, unmount, create, resize and verify disk images. Including encrypted images.
Categories: execution, collection
View authoritative reference ↗ioreg
The I/O Kit registry (ioreg) is a useful binary that can be used to gather data such as detecting if a VM is used, getting USB device vendor names, checking if a screen is locked, etc.
Categories: discovery, collection
View authoritative reference ↗kextstat
Deprecated tool in favor of kmutil. Lists loaded kernel extensions
Categories: discovery
View authoritative reference ↗last
The command shows a list of user sessions including the user name, terminal used, host name, start and stop times, and duration. It also indicates if a session is still active or was terminated unexpectedly.
Categories: discovery
View authoritative reference ↗launchctl
launchctl can be used to load, start, stop, and unload macOS services. It is a command-line frontend to launchd.
Categories: execution, persistence
View authoritative reference ↗log
The log command can be used to access system log messages from Apple Unified Logging (AUL). The tool can be used to inspect existing logs, stream logs in realtime, and delete logs. This tool is normally used by system admins and application developers for troubleshooting purposes but can be used by an adversary to gain an understanding of the user's behavior or to cover up their tracks by deleting log messages.
Categories: defense evasion, credential access
View authoritative reference ↗lsregister
lsregister is used to build, dump, and check the validity of the Launch Services database. This database is often abused to create custom URL scheme handlers that point to malicious apps.
Categories: discovery, impact
View authoritative reference ↗mdfind
mdfind to locate files on MacOS by searching a pre-built database. It is a command-line alternative to Spotlight in MacOS
Categories: reconnaissance, discovery, defense evasion
View authoritative reference ↗mdls
mdls list file metadata across standard metadata (creation date, size), extended attribute (quarantine), and Spotlight APIs (Finder flags).
Categories: defense evasion, discovery, execution, collection
View authoritative reference ↗mktemp
The mktemp binary located in "usr/bin/mktemp" can generate unique directory or file names and has historically been used to generate unique payloads.
Categories: defense evasion
View authoritative reference ↗networksetup
networksetup is an extensive tool for reading and setting various network configuration details useful for Discovery and Command and Control.
Categories: discovery, command and control
View authoritative reference ↗notifyutil
The notifyutil binary is a command-line interface to the notify(3) API and notifyd(8) daemon, which manages Darwin notifications on macOS. This utility enables posting notifications, monitoring system-wide notification keys, and manipulating state values associated with notification keys. While designed for legitimate inter-process communication (IPC), notifyutil can be abused by threat actors to monitor system events (like screen lock, network changes, timezone updates), establish covert communication channels between processes, or gather intelligence about system state changes without triggering traditional security monitoring.
Categories: discovery, collection, command and control, defense evasion, privilege escalation
View authoritative reference ↗nscurl
macOS version of curl that is used to download files to a target without applying the quarantine extended attribute
Categories: defense evasion, command and control
View authoritative reference ↗nvram
Access and manage the host's non-volatile random-access memory (NVRAM).
Categories: discovery
View authoritative reference ↗odutil
To look at internal state information for opendirectoryd, enable or disable logging, or change statistics settings.
Categories: discovery
View authoritative reference ↗open
The open command-line utility can be used to open files, folders, app, URLs or header files in their associate macOS app.
Categories: execution
View authoritative reference ↗osacompile
osacompile is a utility used to compile scripts into executables. It's a component of Open Scripting Architecture (OSA) that Apple uses for its scripting languages, like AppleScript and JavaScript for Automation (JXA). osacompile accepts AppleScript code as input and produces a compiled script file, which can be either a script file (.scpt), an app (.app), a droplet, or a script bundle.
Categories: command and control, resource development
View authoritative reference ↗osascript
The osascript binary is a command-line utility included in macOS that allows users to run AppleScript and Open Scripting Architecture (OSA) scripts or commands. AppleScript is a scripting language that is designed for power users to automate various tasks, application actions, and to interact with the operating system.
Categories: collection, credential access, discovery, execution, defense evasion, privilege escalation, lateral movement
View authoritative reference ↗pbpaste
Retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout). The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands. It can also be used in shell scripts that may require clipboard content as input.
Categories: credential access, collection
View authoritative reference ↗pkill
pkill is a Unix utility available on macOS that sends signals to processes matching a given name or pattern. While intended for legitimate process management, threat actors can abuse pkill to terminate security tools, monitoring daemons, or user applications for defense evasion. It's particularly valuable to attackers as a Living Off the Land technique that avoids bringing custom binaries onto the system.
Categories: defense evasion, impact
View authoritative reference ↗plutil
plutil is a command-line utility used for managing property list (.plist) files. These files are commonly used by macOS to store a app settings and other configuration info. The utility allows users to check the validity of plist files `plutil -lint`, convert plist files between XML and binary formats (plutil -convert), and add, modify or remove plist key value pairs.
Categories: defense evasion
View authoritative reference ↗profiles
Profiles on macOS are responsible for managing different types of profiles including configuration, provisioning, bootstraptoken, or enrollment. However, starting from macOS 11.0, this tool cannot be used for installing configuration profiles.
Categories: discovery, impact
View authoritative reference ↗safaridriver
safaridriver is a tool that is used to enable Selenium testing via the macOS WebDriver protocol. Once enabled, the WebDriver API could be abused by attackers to communicate with external servers for command and control or exfiltration purposes.
Categories: command and control, exfiltration
View authoritative reference ↗say
This tool uses the Speech Synthesis manager to convert input text to audible speech and either play it through the sound output device chosen in System Preferences or save it to an AIFF file.
Categories: defense evasion, collection, reconnaissance, discovery
View authoritative reference ↗screencapture
A tools that allows users to take screenshots of their desktop or specific app windows. The tool can be used by malicious actors to collect sensitive information from the targeted system.
Categories: collection
View authoritative reference ↗scutil
scutil provides a command line interface to the dynamic store data maintained by configd. Interaction with this data (using the SystemConfiguration.framework SCDynamicStore APIs) is handled with a set of commands read from standard input.
Categories: discovery
View authoritative reference ↗security
security is a command-line utility included in macOS that allows users to interact with the Keychain app. Keychains allow users to manager passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.
Categories: credential access, defense evasion
View authoritative reference ↗sfltool
sfltool allows interactions with the Shared File List framework, which can be used to modify application recent documents, favorites, and more.
Categories: discovery, defense evasion
View authoritative reference ↗sharing
sharing (/usr/sbin/sharing) is a macOS command-line utility for creating and managing network file sharing points. It can add, remove, and list shared directories for SMB, AFP, and FTP protocols. In a lateral movement context, an attacker with SSH access to a target can use sharing to create an SMB share on the target, then mount that share from an attacker-controlled machine to transfer files directly to the target's filesystem without additional tooling.
Categories: lateral movement
View authoritative reference ↗snmptrap
macOS ships with the net-snmp toolkit, which includes snmptrap (/usr/bin/snmptrap) for sending SNMP trap notifications and snmptrapd (/usr/sbin/snmptrapd) for receiving them. SNMP traps are unsolicited UDP notifications sent from an agent to a management station on port 162. The trap payload can carry arbitrary string data under custom OIDs in the private enterprise namespace. This mechanism can be repurposed as a covert file transfer channel by base64-encoding file contents, splitting them into fixed-size chunks, and transmitting each chunk as a trap payload. A trap handler on the receiving end reassembles and decodes the file. The transfer blends into SNMP management traffic and uses a protocol that many detection pipelines do not inspect.
Categories: lateral movement, exfiltration, command and control
View authoritative reference ↗softwareupdate
A command-line utility for running software updates.
Categories: discovery
View authoritative reference ↗spctl
Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.
Categories: defense evasion
View authoritative reference ↗sqlite3
sqlite is a command-line utility that allows users to query and manage sqlite databases. Many components of macOS and apps used sqlite to store data. Attackers can leverage this tool to discover sensitive data.
Categories: discovery, collection, credential access
View authoritative reference ↗ssh-keygen
ssh-keygen is a tool for creating new authentication key pairs for SSH (Secure Shell). ssh-keygen holds the "com.apple.security.cs.disable-library-validation" entitlement and is capable of loading arbitrary libraries without requiring signed code.
Categories: execution, defense evasion
View authoritative reference ↗streamzip
streamzip is a system utility that can be utilized to compress data from "stdin" and write the data directly to "stdout", no temporary files are created. The tool can be used by malicious actors to collect and exfiltrate sensitive data without leaving staged data archive artifacts on disk.
Categories: collection, exfiltration
View authoritative reference ↗sw_vers
sw_vers prints macOS version information, including the exact macOS version number.
Categories: discovery
View authoritative reference ↗swift
The swift command is an interactive environment (REPL) for Swift.
Categories: execution, defense evasion
View authoritative reference ↗sysadminctl
sysadminctl can administer system user accounts. sysadminctl can be used to change user passwords, create new users (including automatically provisioning the user home folder) or to check the status of a user's SecureToken.
Categories: initial access, persistence, impact, exfiltration
View authoritative reference ↗sysctl
Gets the macOS hardware information, which can be used to determine whether the target macOS host is running on a physical or virtual machine.
Categories: discovery
View authoritative reference ↗system_profiler
system_profiler reports on the hardware and software configuration of the system. It can generate plain text reports or XML reports which can be opened with System Information.app
Categories: discovery
View authoritative reference ↗systemsetup
systemsetup configures certain per-machine settings typically configured in the System Preferences application. The systemsetup command requires at least "admin" privileges to run.
Categories: lateral movement
View authoritative reference ↗tccutil
tccutil is a command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database. It allows users to revoke permissions for applications to access certain system resources, such as the camera, microphone, and location.
Categories: defense evasion
View authoritative reference ↗tclsh
tclsh is a shell-like utility that runs Tcl from standard input or a file. tclsh holds the "com.apple.security.cs.disable-library-validation" entitlement and is capable of loading arbitrary plug-ins, framework, and libraries without requiring signed code.
Categories: execution
View authoritative reference ↗textutil
The textutil binary is a command-line utility included in macOS that allows users to manipulate text files of various formats, using the mechanisms provided by the Cocoa text system. Formats include rtf, html, docx and others
Categories: defense evasion, collection, credential access
View authoritative reference ↗tftp
macOS ships with both a TFTP client (/usr/bin/tftp) and server daemon (/usr/libexec/tftpd). TFTP is a lightweight, unauthenticated file transfer protocol that operates over UDP. The server is inactive by default but can be activated through launchd using the system-provided plist. In a lateral movement context, an attacker with root access can activate the built-in TFTP server to receive file transfers. Without root, tftpd can be started on a non-standard port using a user-created launchd plist, removing the root requirement entirely.
Categories: lateral movement, persistence, defense evasion
View authoritative reference ↗tmutil
A tool for managing Time Machine, the native macOS backup utility.
Categories: impact, collection, privilege escalation, defense evasion
View authoritative reference ↗xattr
The xattr command can be used to display, modify or remove the extended attributes of one or more files, including directories and symbolic links. Extended attributes are arbitrary metadata stored with a file, but separate from the filesystem attributes (such as modification time or file size). The metadata is often a null-terminated UTF-8 string, but can also be arbitrary binary data. xattr can be used to bypass Gatekeeper.
Categories: execution, defense evasion
View authoritative reference ↗