# mktemp

> Create a temporary file or directory and return the file/directory name to stdout

The mktemp binary located in "usr/bin/mktemp" can generate unique directory or file names and has historically been used to generate unique payloads.

- Page: https://loobins.io/binaries/mktemp/
- Author: Tim Peck (@B0bby_Tablez)
- Created: 2023-06-28
- Tactics: Defense Evasion

## Paths

- `/usr/bin/mktemp`

## Example Use Cases

### Generate payload directory (Shlayer)

The following command can be used to generate a random directory name for staging payloads

```bash
export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"
```

- Tactics: Defense Evasion
- Tags: payload

### Generate directory based on template file (Bundlore)

The following command can be used to generate a unique directory based on a template

```bash
TMP_DIR="mktemp -d -t x"
```

- Tactics: Defense Evasion
- Tags: payload

## Detections

- No detections at time of publishing

## Resources

- [Shlayer malware abusing Gatekeeper bypass on macOS](https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/)
- [20 Common Tools & Techniques Used by macOS Threat Actors & Malware](https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/)