Binaries

Prevent the system from sleeping on behalf of a utility.

Changes file or directory flags

Create, manipulate and verify code signatures.

Configure or view system security policies.

Read, write, and delete user preference values.

Enumerate, mount, erase and manipulate local disks, APFS containers and volumes.

Prevents a process from being terminated when a shell session or terminal is closed.

Copy files and directories while preserving file attributes and permissions.

Discover local network services using the DNS-Based Service Discovery (SD) protocol.

gather information, statistics and initiate queries to the Directory Service cache.

Interact with Directory Services.

retrieves/changes configuration for Directory Services Active Directory Plugin.

Read, create, delete and edit Directory Services group records, including the local admin group.

Enable or disable the macOS root account and set its password from the command line.

Export data from an Open Directory directory services server.

The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.

Get attributes of files and directories.

Manipulate disk images using the DiskImages framework.

Displays a hierarchial view of the I/O Kit registry.

Execute JavaScript and read or write arbitrary files using the JavaScriptCore command-line shell.

Display the status of loaded kernel extensions (kexts)

Activate and configure the built-in Remote Management (Apple Remote Desktop) service from the command line.

Kill processes by name.

Manage, inspect, and load macOS kernel extensions and kext collections.

Show last user logins and TTYs.

Interact with LaunchAgents and LaunchDaemons.

Query LDAP and Active Directory servers for directory objects and attributes.

Access system log messages from Apple Unified Logging (AUL).

Interact with the macOS Launch Services database.

Locate files using the Spotlight database.

List metadata attributes for the specified file.

Create a temporary file or directory and return the file/directory name to stdout

Configure network settings in System Preferences.

Monitor and post Darwin notifications for inter-process communication and system event monitoring.

Download, upload, and read files.

Access and manage the host's non-volatile random-access memory (NVRAM).

odutil allows caller to examine or change state of opendirectoryd

Open files, folders, apps, URLs, and header files.

Compile AppleScripts or OSA language scripts.

Execute AppleScripts and other OSA language scripts and commands.

Write standard input into the macOS pasteboard (clipboard).

Paste the contents of clipboard to the terminal.

Kill processes by name or pattern.

Read and write property list values one key at a time from the command line.

Read, create or edit plist files.

Read and modify macOS power management settings, including scheduled wake/power-on events.

List and remove configuration profiles.

Read and modify Directory Services password policies, account state, and stored hash types.

Enable the WebDriver Safari browser API for Selenium testing.

Convert text to audible speech.

Capture a screenshot from command line.

Create, edit, compile and run AppleScript and JavaScript for Automation scripts.

Display basic network information, check the dns config, set the computer hostname and perform several other tasks.

Interact with Keychain, macOS's built-in password manager.

Set attributes of files and directories.

Binary to manage the Shared File List framework.

Create and manage macOS file sharing points for SMB, AFP, and FTP.

Send SNMP trap notifications; receive them with snmptrapd.

Query and modify the macOS Application Firewall from the command line.

Interact with the macOS software update service.

Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.

Query and manage sqlite databases.

Load unsigned dynamic libraries into the ssh-keygen binary.

File-less compression of data passed in through stdin.

Prints macOS version information.

Arbitrarily execute swift code from the terminal.

Create/delete local accounts, guest account, enable SMB/AFP Guest access.

Get macOS hardware model information.

Reports system hardware and software configuration.

Enumerate and manage system extensions, including EDR and network security extensions.

Enable remote login, remote apple events for the machine

Command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database

Run Tcl files or shell commands from standard input.

Manipulate text files in various formats.

Trivial File Transfer Protocol client and server utilities.

Manage Time Machine backups.

Move files and directories into the user's Trash folder from the command line without invoking rm or unlink.

Display and manipulate extended attributes.