CatalogLOOBins

ORCHARD · Tool

sfltool

2 techniquesmacOSLOOBinsGPL-3.0

Display Login Items

DiscoverymacOS

Identify all current login and background items configured on the system.

sfltool dumpbtm
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery
Detection
Jamf Protect: Detect attempts to dump BTM or being reverted to installation defaults: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sfltool_activity

Reset Login Items to Defaults

Defense EvasionmacOS

Reset all third-party Login Items and revert to installation defaults.

sfltool resetbtm
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion
Detection
Jamf Protect: Detect attempts to dump BTM or being reverted to installation defaults: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sfltool_activity