LOOBins
Living Off the Orchard: macOS Binaries
A curated list of macOS built-in binaries that can be used by threat actors for post-exploitation activities.
82 binaries 279 use cases Browse all
Recently Added
View newest →fdesetup
NewQuery and manage FileVault full disk encryption, users, and recovery keys.
Persistence Defense Impairment Credential Access Discovery Impact
/usr/bin/fdesetup 5 use cases
jsc
NewExecute JavaScript and read or write arbitrary files using the JavaScriptCore command-line shell.
Execution Stealth Credential Access Collection
/System/Library/Frameworks/JavaScriptCore.framework/Versions/Current/Helpers/jsc +3 5 use cases
mdutil
NewManage Spotlight metadata indexing on local and external volumes.
Stealth Discovery
/usr/bin/mdutil 4 use cases
pluginkit
NewRegister, enable, disable, and enumerate app extensions (plug-ins) such as Finder Sync extensions.
Persistence Defense Impairment Discovery
/usr/bin/pluginkit 3 use cases
shortcuts
NewList, run, and sign Shortcuts automation workflows from the command line.
Resource Development Initial Access Execution Stealth Discovery Collection Exfiltration
/usr/bin/shortcuts 4 use cases
systemextensionsctl
NewEnumerate and manage system extensions, including EDR and network security extensions.
Persistence Defense Impairment Discovery Impact
/usr/bin/systemextensionsctl 4 use cases