Collection
13 binaries with this tactic
ditto
Copy files and directories while preserving file attributes and permissions.
CollectionExfiltrationLateral Movement +2 filescompressrecursive
hdiutil
Manipulate disk images using the DiskImages framework.
ExecutionCollection bashzshdisk
ioreg
Displays a hierarchial view of the I/O Kit registry.
DiscoveryCollection bashonelinerlockscreen +1
mdls
List metadata attributes for the specified file.
Defense EvasionDiscoveryExecution +1 genieoshlayercleanmaster +4
notifyutil
Monitor and post Darwin notifications for inter-process communication and system event monitoring.
DiscoveryCollectionCommand and Control +2 monitoringsurveillancesystem-events +10
osascript
Execute AppleScripts and other OSA language scripts and commands.
CollectionCredential AccessDiscovery +4 clipboardbashoneliner +15
pbpaste
Paste the contents of clipboard to the terminal.
Credential AccessCollection bashoneliner
say
Convert text to audible speech.
Defense EvasionCollectionReconnaissance +1 bashpbpasteclipboard +1
screencapture
Capture a screenshot from command line.
Collection oneliner
sqlite3
Query and manage sqlite databases.
DiscoveryCollectionCredential Access permissionsonelinercookie-theft
streamzip
File-less compression of data passed in through stdin.
CollectionExfiltration filescompress
textutil
Manipulate text files in various formats.
Defense EvasionCollectionCredential Access bashonelinerpbpaste +1
tmutil
Manage Time Machine backups.
ImpactCollectionPrivilege Escalation +1 backupdeleterestore +1