# sfltool

> Binary to manage the Shared File List framework.

sfltool allows interactions with the Shared File List framework, which can be used to modify application recent documents, favorites, and more.

- Page: https://loobins.io/binaries/sfltool/
- Author: Eliott (@Koyiott)
- Created: 2023-09-12
- Tactics: Defense Evasion, Discovery

## Paths

- `/usr/bin/sfltool`

## Example Use Cases

### Display Login Items

Identify all current login and background items configured on the system.

```bash
sfltool dumpbtm
```

- Tactics: Discovery
- Tags: bash, startup

### Reset Login Items to Defaults

Reset all third-party Login Items and revert to installation defaults.

```bash
sfltool resetbtm
```

- Tactics: Defense Evasion
- Tags: bash, system-reset

## Detections

- [Jamf Protect: Detect attempts to dump BTM or being reverted to installation defaults](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sfltool_activity)

## Resources

- [sfltool man page](https://www.unix.com/man-page/mojave/1/sfltool/)
- [Controlling login and background items](https://eclecticlight.co/2023/02/15/controlling-login-and-background-items-in-ventura/)