# plutil

> Read, create or edit plist files.

plutil is a command-line utility used for managing property list (.plist) files. These files are commonly used by macOS to store a app settings and other configuration info. The utility allows users to check the validity of plist files `plutil -lint`, convert plist files between XML and binary formats (plutil -convert), and add, modify or remove plist key value pairs.

- Page: https://loobins.io/binaries/plutil/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-07
- Tactics: Defense Evasion

## Paths

- `/usr/bin/plutil`

## Example Use Cases

### Set app to run with dock icon hidden

plutil can be used to set the "LSUIElement" attribute to true which will force the targeted app to run without the UI and dock icon.

```bash
plutil -insert LSUIElement -string "1" /Applications/TargetApp.app/Contents/Info.plist
```

- Tactics: Defense Evasion
- Tags: plist

## Detections

- [Splunk Security Content: MacOS plutil](https://research.splunk.com/endpoint/c11f2b57-92c1-4cd2-b46c-064eafb833ac/)

## Resources

- [Editing Property Lists with plutil](https://scriptingosx.com/2016/11/editing-property-lists/)
- [Plist File Modification (MITRE ATT&CK)](https://attack.mitre.org/techniques/T1647/)