# LOOBins

> LOOBins (Living Off the Orchard: macOS Binaries) is a curated catalog of macOS built-in binaries that threat actors can abuse for post-exploitation, with example commands mapped to MITRE ATT&CK tactics, plus detection and reference links.

Each binary below links to a markdown version of its page. Entries list the binary paths, example commands (which are illustrative abuse examples, not detection signatures), the ATT&CK tactics they map to, and detection references. Built-in Unix binaries already covered by GTFOBins are only included when they have macOS-specific abuse.

## Binaries

- [caffeinate](https://loobins.io/binaries/caffeinate.md): Prevent the system from sleeping on behalf of a utility.
- [chflags](https://loobins.io/binaries/chflags.md): Changes file or directory flags
- [codesign](https://loobins.io/binaries/codesign.md): Create, manipulate and verify code signatures.
- [csrutil](https://loobins.io/binaries/csrutil.md): Configure or view system security policies.
- [defaults](https://loobins.io/binaries/defaults.md): Read, write, and delete user preference values.
- [diskutil](https://loobins.io/binaries/diskutil.md): Enumerate, mount, erase and manipulate local disks, APFS containers and volumes.
- [disown](https://loobins.io/binaries/disown.md): Prevents a process from being terminated when a shell session or terminal is closed.
- [ditto](https://loobins.io/binaries/ditto.md): Copy files and directories while preserving file attributes and permissions.
- [dns-sd](https://loobins.io/binaries/dns-sd.md): Discover local network services using the DNS-Based Service Discovery (SD) protocol.
- [dscacheutil](https://loobins.io/binaries/dscacheutil.md): gather information, statistics and initiate queries to the Directory Service cache.
- [dscl](https://loobins.io/binaries/dscl.md): Interact with Directory Services.
- [dsconfigad](https://loobins.io/binaries/dsconfigad.md): retrieves/changes configuration for Directory Services Active Directory Plugin.
- [dseditgroup](https://loobins.io/binaries/dseditgroup.md): Read, create, delete and edit Directory Services group records, including the local admin group.
- [dsenableroot](https://loobins.io/binaries/dsenableroot.md): Enable or disable the macOS root account and set its password from the command line.
- [dsexport](https://loobins.io/binaries/dsexport.md): Export data from an Open Directory directory services server.
- [funzip](https://loobins.io/binaries/funzip.md): The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.
- [GetFileInfo](https://loobins.io/binaries/getfileinfo.md): Get attributes of files and directories.
- [hdiutil](https://loobins.io/binaries/hdiutil.md): Manipulate disk images using the DiskImages framework.
- [ioreg](https://loobins.io/binaries/ioreg.md): Displays a hierarchial view of the I/O Kit registry.
- [kextstat](https://loobins.io/binaries/kextstat.md): Display the status of loaded kernel extensions (kexts)
- [kickstart](https://loobins.io/binaries/kickstart.md): Activate and configure the built-in Remote Management (Apple Remote Desktop) service from the command line.
- [killall](https://loobins.io/binaries/killall.md): Kill processes by name.
- [kmutil](https://loobins.io/binaries/kmutil.md): Manage, inspect, and load macOS kernel extensions and kext collections.
- [last](https://loobins.io/binaries/last.md): Show last user logins and TTYs.
- [launchctl](https://loobins.io/binaries/launchctl.md): Interact with LaunchAgents and LaunchDaemons.
- [ldapsearch](https://loobins.io/binaries/ldapsearch.md): Query LDAP and Active Directory servers for directory objects and attributes.
- [log](https://loobins.io/binaries/log.md): Access system log messages from Apple Unified Logging (AUL).
- [lsregister](https://loobins.io/binaries/lsregister.md): Interact with the macOS Launch Services database.
- [mdfind](https://loobins.io/binaries/mdfind.md): Locate files using the Spotlight database.
- [mdls](https://loobins.io/binaries/mdls.md): List metadata attributes for the specified file.
- [mktemp](https://loobins.io/binaries/mktemp.md): Create a temporary file or directory and return the file/directory name to stdout
- [networksetup](https://loobins.io/binaries/networksetup.md): Configure network settings in System Preferences.
- [notifyutil](https://loobins.io/binaries/notifyutil.md): Monitor and post Darwin notifications for inter-process communication and system event monitoring.
- [nscurl](https://loobins.io/binaries/nscurl.md): Download, upload, and read files.
- [nvram](https://loobins.io/binaries/nvram.md): Access and manage the host's non-volatile random-access memory (NVRAM).
- [odutil](https://loobins.io/binaries/odutil.md): odutil allows caller to examine or change state of opendirectoryd
- [open](https://loobins.io/binaries/open.md): Open files, folders, apps, URLs, and header files.
- [osacompile](https://loobins.io/binaries/osacompile.md): Compile AppleScripts or OSA language scripts.
- [osascript](https://loobins.io/binaries/osascript.md): Execute AppleScripts and other OSA language scripts and commands.
- [pbcopy](https://loobins.io/binaries/pbcopy.md): Write standard input into the macOS pasteboard (clipboard).
- [pbpaste](https://loobins.io/binaries/pbpaste.md): Paste the contents of clipboard to the terminal.
- [pkill](https://loobins.io/binaries/pkill.md): Kill processes by name or pattern.
- [PlistBuddy](https://loobins.io/binaries/plistbuddy.md): Read and write property list values one key at a time from the command line.
- [plutil](https://loobins.io/binaries/plutil.md): Read, create or edit plist files.
- [pmset](https://loobins.io/binaries/pmset.md): Read and modify macOS power management settings, including scheduled wake/power-on events.
- [profiles](https://loobins.io/binaries/profiles.md): List and remove configuration profiles.
- [pwpolicy](https://loobins.io/binaries/pwpolicy.md): Read and modify Directory Services password policies, account state, and stored hash types.
- [safaridriver](https://loobins.io/binaries/safaridriver.md): Enable the WebDriver Safari browser API for Selenium testing.
- [say](https://loobins.io/binaries/say.md): Convert text to audible speech.
- [screencapture](https://loobins.io/binaries/screencapture.md): Capture a screenshot from command line.
- [Script Editor](https://loobins.io/binaries/script_editor.md): Create, edit, compile and run AppleScript and JavaScript for Automation scripts.
- [scutil](https://loobins.io/binaries/scutil.md): Display basic network information, check the dns config, set the computer hostname and perform several other tasks.
- [security](https://loobins.io/binaries/security.md): Interact with Keychain, macOS's built-in password manager.
- [SetFile](https://loobins.io/binaries/setfile.md): Set attributes of files and directories.
- [sfltool](https://loobins.io/binaries/sfltool.md): Binary to manage the Shared File List framework.
- [sharing](https://loobins.io/binaries/sharing.md): Create and manage macOS file sharing points for SMB, AFP, and FTP.
- [snmptrap](https://loobins.io/binaries/snmptrap.md): Send SNMP trap notifications; receive them with snmptrapd.
- [socketfilterfw](https://loobins.io/binaries/socketfilterfw.md): Query and modify the macOS Application Firewall from the command line.
- [softwareupdate](https://loobins.io/binaries/softwareupdate.md): Interact with the macOS software update service.
- [spctl](https://loobins.io/binaries/spctl.md): Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.
- [sqlite3](https://loobins.io/binaries/sqlite3.md): Query and manage sqlite databases.
- [ssh-keygen](https://loobins.io/binaries/ssh-keygen.md): Load unsigned dynamic libraries into the ssh-keygen binary.
- [streamzip](https://loobins.io/binaries/streamzip.md): File-less compression of data passed in through stdin.
- [sw_vers](https://loobins.io/binaries/sw_vers.md): Prints macOS version information.
- [swift](https://loobins.io/binaries/swift.md): Arbitrarily execute swift code from the terminal.
- [sysadminctl](https://loobins.io/binaries/sysadminctl.md): Create/delete local accounts, guest account, enable SMB/AFP Guest access.
- [sysctl](https://loobins.io/binaries/sysctl.md): Get macOS hardware model information.
- [system_profiler](https://loobins.io/binaries/system_profiler.md): Reports system hardware and software configuration.
- [systemsetup](https://loobins.io/binaries/systemsetup.md): Enable remote login, remote apple events for the machine
- [tccutil](https://loobins.io/binaries/tccutil.md): Command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database
- [tclsh](https://loobins.io/binaries/tclsh.md): Run Tcl files or shell commands from standard input.
- [textutil](https://loobins.io/binaries/textutil.md): Manipulate text files in various formats.
- [tftp](https://loobins.io/binaries/tftp.md): Trivial File Transfer Protocol client and server utilities.
- [tmutil](https://loobins.io/binaries/tmutil.md): Manage Time Machine backups.
- [trash](https://loobins.io/binaries/trash.md): Move files and directories into the user's Trash folder from the command line without invoking rm or unlink.
- [xattr](https://loobins.io/binaries/xattr.md): Display and manipulate extended attributes.

## Data

- [loobins.json](https://loobins.io/loobins.json): Every entry as structured JSON
- [llms-full.txt](https://loobins.io/llms-full.txt): Every entry as a single markdown document
- [Schema](https://github.com/infosecB/LOOBins/blob/main/docs/schema.md): YAML schema for entries

## Optional

- [GitHub repository](https://github.com/infosecB/LOOBins): Source YAML and contribution guide
- [PyLOOBins](https://pypi.org/project/pyloobins/): Python SDK and CLI with STIX 2 export