# defaults

> Read, write, and delete user preference values.

The defaults binary is normally used to interact with the user defaults system, a database of macOS used to manage system settings much like the Windows Registry. The database can be abused by threat actors to change settings in attempt to evade defenses or to gain persistence.

- Page: https://loobins.io/binaries/defaults/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-24
- Tactics: Persistence, Defense Evasion, Discovery

## Paths

- `/usr/bin/defaults`

## Example Use Cases

### Disable Gatekeeper's auto rearm functionality

The following command can be used to disable Gatekeepers rearm functionality. This command requires root privileges.

```bash
sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool NO
```

- Tactics: Defense Evasion
- Tags: gatekeeper

### Show mounted servers

Show all mounted servers on the desktop.

```bash
defaults read com.apple.finder "ShowMountedServersOnDesktop"
```

- Tactics: Discovery

### Add a login item to the current user

An attacker can use defaults to add a login hook in attempt to gain persistence. This command requires root privileges.

```bash
sudo defaults write /Library/Preferences/com.apple.loginwindow LoginHook gain_persistence.sh
```

- Tactics: Persistence

### Get Active Directory user info from Jamf Connect

Retrieve Active Directory user info from Jamf Connect defaults configuration.

```bash
defaults read com.jamf.connect.state
```

- Tactics: Discovery

### Enable Firewall

Enables macOS' default firewall. This command requires root privileges.

```bash
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1
```

- Tactics: Defense Evasion
- Tags: firewall

### Disable Firewall

Disables macOS' default firewall. This command requires root privileges.

```bash
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 0
```

- Tactics: Defense Evasion
- Tags: firewall

## Detections

- No detections at time of publishing

## Resources

- [macOS defaults list: Uncomplete list of macOS defaults commands with demos](https://macos-defaults.com/)
- [Insistence on Persistence](https://www.huntress.com/blog/insistence-on-persistence)