ssh-keygen

An attacker can execute a malicious .dylib from stdin by echoing a load command and piping to tclsh. This will bypass code signing requirements.

ssh-keygen -D /private/tmp/evil.dylib

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Execution, Defense Evasion

Detection

Recommendations included in resource below. No formal detection content at this time.: medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ssh-keygen.yml

medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d