sfltool

Created by Eliott (@Koyiott)

Description

sfltool allows interactions with the Shared File List framework, which can be used to modify application recent documents, favorites, and more.

CreatedTacticsTags
2023-09-12Discovery Defense Evasionbash startup system_reset

Paths

  • /usr/bin/sfltool

Use Cases

Display Login Items

Identify all current login and background items configured on the system.

sfltool dumpbtm

Reset Login Items to Defaults

Reset all third-party Login Items and revert to installation defaults.

sfltool resetbtm

Detections

Resources