LOOBins
Living Off the Orchard: macOS Binaries
A curated list of macOS built-in binaries that can be used by threat actors for post-exploitation activities.
78 binaries 263 use cases Browse all
Recently Added
View newest →jsc
NewExecute JavaScript and read or write arbitrary files using the JavaScriptCore command-line shell.
Execution Stealth Credential Access Collection
/System/Library/Frameworks/JavaScriptCore.framework/Versions/Current/Helpers/jsc +3 5 use cases
systemextensionsctl
NewEnumerate and manage system extensions, including EDR and network security extensions.
Persistence Defense Impairment Discovery Impact
/usr/bin/systemextensionsctl 4 use cases
Script Editor
NewCreate, edit, compile and run AppleScript and JavaScript for Automation scripts.
Execution Stealth
/System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor 1 use case
diskutil
NewEnumerate, mount, erase and manipulate local disks, APFS containers and volumes.
Privilege Escalation Stealth Defense Impairment Credential Access Discovery Collection Impact
/usr/sbin/diskutil 12 use cases
dseditgroup
NewRead, create, delete and edit Directory Services group records, including the local admin group.
Persistence Privilege Escalation Defense Impairment Discovery Lateral Movement
/usr/sbin/dseditgroup 5 use cases
dsenableroot
NewEnable or disable the macOS root account and set its password from the command line.
Persistence Privilege Escalation Stealth
/usr/sbin/dsenableroot 3 use cases