CatalogLOOBins

ORCHARD · Tool

mdfind

3 techniquesmacOSLOOBinsGPL-3.0

Use mdfind to provide live updates to the number of files matching the query

DiscoverymacOS

A bash or zsh oneliner can cause mdfind to provide an attacker with live updates to the number of files on a system.

mdfind -live passw
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Reconnaissance, Discovery
Detection
Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys

Use mdfind to search for AWS Keys

DiscoverymacOS

Allows an attacker to query the filesystem via the CommandLine/Terminal to search for AWS keys.

mdfind 'kMDItemTextContext == AKIA || kMDItemDisplayName = *AKIA* -onlyin ~'
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Reconnaissance, Discovery
Detection
Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys

Use mdfind to search for apps to infect

DiscoveryDefense EvasionmacOS

Allows an attacker to determine if specific applications are installed and can be leveraged

set appId to do shell script "mdfind kMDItemCFBundleIdentifier = '" & bundleId & "'"
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Reconnaissance, Discovery, Defense Evasion
Detection
Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys