LOOBins
Living Off the Orchard: macOS Binaries
A curated list of macOS built-in binaries that can be used by threat actors for post-exploitation activities.
76
Binaries
14
Tactics
254
Use Cases
Recently Added
Script Editor
Create, edit, compile and run AppleScript and JavaScript for Automation scripts.
diskutil
Enumerate, mount, erase and manipulate local disks, APFS containers and volumes.
dseditgroup
Read, create, delete and edit Directory Services group records, including the local admin group.
dsenableroot
Enable or disable the macOS root account and set its password from the command line.
kickstart
Activate and configure the built-in Remote Management (Apple Remote Desktop) service from the command line.
kmutil
Manage, inspect, and load macOS kernel extensions and kext collections.