tclsh

An attacker can execute a malicious .dylib from stdin by echoing a load command and piping to tclsh. This will bypass code signing requirements.

echo "load bad.dylib" | tclsh

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Execution

Detection

Recommendations included in resource below. No formal detection content at this time.: medium.com/specter-ops-posts/dylib-loads-that-tickle-your-fancy-d25196addd8c

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tclsh.yml

medium.com/specter-ops-posts/dylib-loads-that-tickle-your-fancy-d25196addd8c