pluginkit

pluginkit manages the PlugInKit subsystem for the current user, which tracks app extensions such as Finder Sync, Quick Look, Share, and Safari web extensions. It can query the plug-in database, explicitly register extensions from arbitrary paths, and set the user election that controls whether an extension is used. Because it operates on the current user's database, no root access is required. Attackers can register and enable a malicious Finder Sync extension so that it is automatically launched by the system, enumerate installed extensions, and disable extensions belonging to security or data loss prevention products.

Persistence Defense Impairment Discovery

Path: /usr/bin/pluginkit
Author: Brendan Chamberlain (@infosecB)
Created: 2026-11-07

Example Use Cases 3

Enumerate registered app extensions #

List all registered app extensions with their paths, versions, and parent applications. Filtering by extension point (protocol) identifies Finder Sync extensions, Quick Look previewers, and Safari web extensions. The leading + or - on each line shows whether the user has elected to use or ignore the extension.

pluginkit -mAvvv
pluginkit -mAvvv -p com.apple.FinderSync
pluginkit -mA -p com.apple.Safari.web-extension

Discovery oneliner bash

Persist through a malicious Finder Sync extension #

Register a Finder Sync extension bundled with an attacker-controlled application, then elect to use it. Once enabled, the extension is launched automatically by the system whenever Finder runs, without a LaunchAgent or login item.

pluginkit -a /Applications/Updater.app/Contents/PlugIns/UpdaterSync.appex
pluginkit -e use -i com.example.Updater.UpdaterSync

Persistence bash finder

Disable a security product's app extension #

Elect to ignore an extension by bundle ID, which stops it from being used for the current user. This can disable extensions that provide security or data loss prevention functionality, such as Finder Sync or Safari content-blocking extensions.

pluginkit -e ignore -i <extension bundle ID>

Defense Impairment oneliner bash

Detections

Finder Sync Plugin Registered and Enabled - Elastic
Command-line detection: pluginkit -a with an extension path outside /Applications or /System, or pluginkit -e ignore executed by a script interpreter or unsigned process

Resources

Acknowledgements

Csaba Fitzl (@theevilbit)