CatalogLOOBins

ORCHARD · Tool

defaults

6 techniquesmacOSLOOBinsGPL-3.0

Disable Gatekeeper's auto rearm functionality

Defense EvasionmacOS

The following command can be used to disable Gatekeepers rearm functionality. This command requires root privileges.

sudo defaults write /Library/Preferences/com.apple.security GKAutoRearm -bool NO
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion
Detection
No detections at time of publishing: No detections at time of publishing

Show mounted servers

DiscoverymacOS

Show all mounted servers on the desktop.

defaults read com.apple.finder "ShowMountedServersOnDesktop"
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery
Detection
No detections at time of publishing: No detections at time of publishing

Add a login item to the current user

PersistencemacOS

An attacker can use defaults to add a login hook in attempt to gain persistence. This command requires root privileges.

sudo defaults write /Library/Preferences/com.apple.loginwindow LoginHook gain_persistence.sh
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Persistence
Detection
No detections at time of publishing: No detections at time of publishing

Get Active Directory user info from Jamf Connect

DiscoverymacOS

Retrieve Active Directory user info from Jamf Connect defaults configuration.

defaults read com.jamf.connect.state
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery
Detection
No detections at time of publishing: No detections at time of publishing

Enable Firewall

Defense EvasionmacOS

Enables macOS' default firewall. This command requires root privileges.

sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion
Detection
No detections at time of publishing: No detections at time of publishing

Disable Firewall

Defense EvasionmacOS

Disables macOS' default firewall. This command requires root privileges.

sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 0
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion
Detection
No detections at time of publishing: No detections at time of publishing