socketfilterfw

socketfilterfw is the command-line control for the macOS Application Layer Firewall (ALF), the built-in firewall that filters inbound network connections on a per-application basis. It lives in its own libexec subdirectory rather than a standard bin path and is normally used by administrators and MDM tooling to turn the firewall on or off, toggle stealth and block-all modes, and allow or block individual applications. Every one of these operations is a single root command with no GUI interaction. An attacker who already has root can use it to weaken the host's inbound network defenses by disabling the firewall, or by pre-authorizing a planted listener so an inbound bind shell or command-and-control implant accepts connections without ever raising the "allow incoming connections?" prompt. The ALF only governs inbound traffic, so socketfilterfw does not help hide outbound beacons.