CatalogLOOBins

ORCHARD · Tool

lsregister

3 techniquesmacOSLOOBinsGPL-3.0

Force an update of the Launch Services database

DiscoverymacOS

The -f flag can be used to force an update of the Launch Services database. This can be used to quickly register a custom URL scheme that points to a malicious app.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -f
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery
Detection
No detections at time of publishing: No detections at time of publishing

Get a list of apps and their bindings

DiscoverymacOS

The -dump flag can be used to get a list of apps and their bindings

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -E "path:|bindings:|name: | more"
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery
Detection
No detections at time of publishing: No detections at time of publishing

Delete the Launch Services database

macOS

The -delete flag can be used to delete the Launch Services database to impact normal operation of the system.

lsregister -delete
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Impact
Detection
No detections at time of publishing: No detections at time of publishing