dns-sd

Hosts serving SSH can be discovered using the _ssh._tcp service string.

dns-sd -B _ssh._tcp

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect dns-sd discovery activity: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml

themittenmac.com/what-does-apt-activity-look-like-on-macos

jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/

Hosts serving web services can be discovered using the _http._tcp service string.

dns-sd -B _http._tcp

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect dns-sd discovery activity: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml

themittenmac.com/what-does-apt-activity-look-like-on-macos

jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/

Hosts serving remote screen sharing can be discovered using the _rfb._tcp service string.

dns-sd -B _rfb._tcp

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect dns-sd discovery activity: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml

themittenmac.com/what-does-apt-activity-look-like-on-macos

jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/

Hosts serving SMB can be discovered using the _smb._tcp service string.

dns-sd -B _smb._tcp

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect dns-sd discovery activity: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml

themittenmac.com/what-does-apt-activity-look-like-on-macos

jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/