About LOOBins

LOOBins (Living Off the Orchard: macOS Binaries) is a community-driven project documenting macOS built-in binaries that can be used by threat actors for post-exploitation activities.

Inspired by projects like GTFOBins and LOLBAS, LOOBins focuses specifically on macOS and the unique binaries available in Apple's ecosystem.

What Makes LOOBins Different?

Focuses exclusively on macOS-specific binaries
Maps use cases to MITRE ATT&CK tactics
Includes detection guidance for each technique
Provides a Python SDK (PyLOOBins) for programmatic access
Exports data in STIX 2.0 format for threat intelligence platforms

Used By

LOOBins data is referenced in detection content, adversary emulation, and security research across the industry. Each entry below links to a public example.

Elastic

Elastic Detection Rules

macOS detection rules cite LOOBins entries as references.

Splunk

Splunk Security Content

macOS detections and analytic stories reference LOOBins.

Sumo Logic

Cloud SIEM Content Catalog

First-seen macOS binary rules are built on LOOBins data.

Red Canary

Atomic Red Team

macOS atomic tests are sourced from LOOBins entries.

North Pole Security

Santa

The CEL policy cookbook references LOOBins.

Magic Sword

Magic Atomics

Ingests LOOBins as a data source.

Securonix

Threat Research

Published detection guidance for LOOBins attack activity.

Using LOOBins in your product or project? Open an issue to be added to this list.

Contributing

LOOBins is open source and welcomes contributions. If you know of a macOS binary that can be abused by threat actors, please consider submitting a LOOBin entry.

See the Contributing Guide for details on how to submit new entries.