LOOBins
Living Off the Orchard: macOS Binaries
A curated list of macOS built-in binaries that can be used by threat actors for post-exploitation activities.
75
Binaries
14
Tactics
251
Use Cases
Recently Added
diskutil
Enumerate, mount, erase and manipulate local disks, APFS containers and volumes.
dseditgroup
Read, create, delete and edit Directory Services group records, including the local admin group.
dsenableroot
Enable or disable the macOS root account and set its password from the command line.
kickstart
Activate and configure the built-in Remote Management (Apple Remote Desktop) service from the command line.
kmutil
Manage, inspect, and load macOS kernel extensions and kext collections.
ldapsearch
Query LDAP and Active Directory servers for directory objects and attributes.