sfltool #

Created by Eliott (@Koyiott)

Description ##

sfltool allows interactions with the Shared File List framework, which can be used to modify application recent documents, favorites, and more.

Paths ##

• /usr/bin/sfltool

Use Cases ##

Display Login Items ##

Identify all current login and background items configured on the system.

sfltool dumpbtm

Reset Login Items to Defaults ##

Reset all third-party Login Items and revert to installation defaults.

sfltool resetbtm

Detections ##

• Jamf Protect: Detect attempts to dump BTM or being reverted to installation defaults

Resources ##

• sfltool man page

• Controlling login and background items