# mdfind

> Locate files using the Spotlight database.

mdfind to locate files on MacOS by searching a pre-built database. It is a command-line alternative to Spotlight in MacOS

- Page: https://loobins.io/binaries/mdfind/
- Author: Chris Campbell (@texasbe2trill)
- Created: 2023-04-22
- Tactics: Reconnaissance, Defense Evasion, Discovery

## Paths

- `/usr/bin/mdfind`

## Example Use Cases

### Use mdfind to provide live updates to the number of files matching the query

A bash or zsh oneliner can cause mdfind to provide an attacker with live updates to the number of files on a system.

```bash
mdfind -live passw
```

- Tactics: Reconnaissance, Discovery
- Tags: bash, zsh, oneliner

### Use mdfind to search for AWS Keys

Allows an attacker to query the filesystem via the CommandLine/Terminal to search for AWS keys.

```bash
mdfind 'kMDItemTextContext == AKIA || kMDItemDisplayName = *AKIA* -onlyin ~'
```

- Tactics: Reconnaissance, Discovery
- Tags: bash, zsh, oneliner

### Use mdfind to search for apps to infect

Allows an attacker to determine if specific applications are installed and can be leveraged

```bash
set appId to do shell script "mdfind kMDItemCFBundleIdentifier = '" & bundleId & "'"
```

- Tactics: Reconnaissance, Defense Evasion, Discovery
- Tags: osascript, xcsset

## Detections

- [Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys)

## Resources

- ["Farming The Apple Orchards: Living off the Land Techniques" - Chris Ross & Cedric Owens](https://youtu.be/Snwh4mMe-Cg?t=45)
- ["Zero-Day TCC bypass discovered in XCSSET malware" - Jaron Bradley, Ferdous Saljooki, Stuart Ashenbrenner](https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/)