Use the textutil to read several files and build a new file
Defense EvasionCollectionmacOS
A one-liner can load the content of multiple RTF files in a directory, concatenate their contents, and write the results out as a new file. This provides two sub-use-cases; one is building a malicious file from a collection of smaller files which could evade both network and host-based security controls as the traditional means of signature-based detection would be redundant; two is concatenating the content of several, potentially sensitive files before exfiltration. This command can also be looped to iterate a directory of files.
textutil-converthtmlQuote.docsecondQuote.doc
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion, Collection
Detection
Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste)): Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste))
By leveraging another command line tool, pbpaste, it is possible to write a one-liner which captures the content of the clipboard. If an attacker already has access to the system, the attacker could run this command to obtain sensitive information such as a password and then elevate their privileges or exfiltrate the information.
pbpaste|textutil-stdin-info>Clipboard.txt
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Credential Access, Collection
Detection
Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste)): Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste))