LOOBins
Living Off the Orchard: macOS Binaries
A curated list of macOS built-in binaries that can be used by threat actors for post-exploitation activities.
76 binaries 254 use cases Browse all
Recently Added
View newest →Script Editor
NewCreate, edit, compile and run AppleScript and JavaScript for Automation scripts.
Execution Defense Evasion
/System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor 1 use case
diskutil
NewEnumerate, mount, erase and manipulate local disks, APFS containers and volumes.
Privilege Escalation Defense Evasion Credential Access Discovery Collection Impact
/usr/sbin/diskutil 12 use cases
dseditgroup
NewRead, create, delete and edit Directory Services group records, including the local admin group.
Persistence Privilege Escalation Defense Evasion Discovery Lateral Movement
/usr/sbin/dseditgroup 5 use cases
dsenableroot
NewEnable or disable the macOS root account and set its password from the command line.
Persistence Privilege Escalation Defense Evasion
/usr/sbin/dsenableroot 3 use cases
kickstart
NewActivate and configure the built-in Remote Management (Apple Remote Desktop) service from the command line.
Persistence Defense Evasion Lateral Movement Collection Command and Control
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart 6 use cases
kmutil
NewManage, inspect, and load macOS kernel extensions and kext collections.
Persistence Privilege Escalation Defense Evasion Discovery Impact
/usr/bin/kmutil 6 use cases