CatalogLOOBins

ORCHARD · Tool

mdls

3 techniquesmacOSLOOBinsGPL-3.0

Validate file download information

Defense EvasionmacOS

Use mdls to validate payload download sources and timestamps to guard against sandbox executions.

mdls -name "kMDItemWhereFroms" -name "kMDItemDownloadedDate"
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion
Detection
No detections at time of publishing: No detections at time of publishing

Query File Paths

DiscoverymacOS

Use mdls to print file paths and sizes when enumerating host resources.

xargs -0 mdls -n kMDItemPath -n kMDItemFSSize
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery
Detection
No detections at time of publishing: No detections at time of publishing

Extract and execute payload stored in Finder comment metadata

ExecutionCollectionDefense EvasionmacOS

Every file on macOS has a Finder comment field stored as Spotlight metadata under the kMDItemFinderComment attribute. mdls can read this field and pipe its contents to a decoder and executor. Because the payload lives entirely in Spotlight metadata rather than file contents, it is not visible to file-based inspection or integrity monitoring tools. Finder comments can be written remotely via osascript over Remote Apple Events or SSH, making this a covert staging mechanism for lateral movement payloads.

mdls -name kMDItemFinderComment -raw ~/Desktop/payload_carrier.txt | base64 -D | bash
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Execution, Collection, Defense Evasion
Detection
No detections at time of publishing: No detections at time of publishing