# mdls

> List metadata attributes for the specified file.

mdls list file metadata across standard metadata (creation date, size), extended attribute (quarantine), and Spotlight APIs (Finder flags).

- Page: https://loobins.io/binaries/mdls/
- Author: Daniel Stinson-Diess (@shellcromancer)
- Created: 2023-05-29
- Tactics: Execution, Defense Evasion, Discovery, Collection

## Paths

- `/usr/bin/mdls`

## Example Use Cases

### Validate file download information

Use mdls to validate payload download sources and timestamps to guard against sandbox executions.

```bash
mdls -name "kMDItemWhereFroms" -name "kMDItemDownloadedDate"
```

- Tactics: Defense Evasion
- Tags: genieo, shlayer

### Query File Paths

Use mdls to print file paths and sizes when enumerating host resources.

```bash
xargs -0 mdls -n kMDItemPath -n kMDItemFSSize
```

- Tactics: Discovery
- Tags: cleanmaster

### Extract and execute payload stored in Finder comment metadata

Every file on macOS has a Finder comment field stored as Spotlight metadata under the kMDItemFinderComment attribute. mdls can read this field and pipe its contents to a decoder and executor. Because the payload lives entirely in Spotlight metadata rather than file contents, it is not visible to file-based inspection or integrity monitoring tools. Finder comments can be written remotely via osascript over Remote Apple Events or SSH, making this a covert staging mechanism for lateral movement payloads.

```bash
mdls -name kMDItemFinderComment -raw ~/Desktop/payload_carrier.txt | base64 -D | bash
```

- Tactics: Execution, Defense Evasion, Collection
- Tags: finder-comment, spotlight, payload-execution, covert-storage

## Detections

- No detections at time of publishing

## Resources

- [Bad Apples: Weaponizing Native macOS Primitives for Movement and Execution](https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/)

## Acknowledgements

- Ryan Conry (Cisco Talos, Finder comment payload extraction use case)