plutil #

Created by Brendan Chamberlain (@infosecB)

Description ##

plutil is a command-line utility used for managing property list (.plist) files. These files are commonly used by macOS to store a app settings and other configuration info. The utility allows users to check the validity of plist files plutil -lint, convert plist files between XML and binary formats (plutil -convert), and add, modify or remove plist key value pairs.

Paths ##

• /usr/bin/plutil

Use Cases ##

Set app to run with dock icon hidden ##

plutil can be used to set the “LSUIElement” attribute to tue which will force the targeted app to run without the UI and dock icon.

plutil -insert LSUIElement -string "1" /Applications/TargetApp.app/Contents/Info.plist

Detections ##

• Splunk Security Content: MacOS plutil

Resources ##

• Editing Property Lists with plutil

• Plist File Modification (MITRE ATT&CK)