macOS Living-off-the-Orchard Binaries (LOOBins)

Osascript executes Open Scripting Architecture (OSA) scripts such as AppleScript and JavaScript for Automation (JXA). Widely used in macOS malware to display convincing phishing dialogs, harvest credentials, control System Events, and execute shell commands.

The open command opens files, directories, URLs, and applications as if you double-clicked them in Finder. Used to launch unsigned or quarantined applications and evade Gatekeeper or security software inspection.

Curl is standard on macOS and frequently invoked in bash/zsh shell scripts by macOS stealers (e.g. Atomic macOS Stealer / AMOS) to fetch stage 2 Mach-O executables or exfiltrate keychain data.

Directory Service command-line utility (dscl) allows reading and writing Directory Service databases. Attackers use dscl for local user discovery, creating hidden administrator accounts, or extracting password hashes.

Defaults reads and writes macOS user defaults and plist configuration files. Attackers abuse it to write LoginHook scripts or alter ScreenSaver preferences to achieve reboot persistence.

Plutil checks and transforms property list (.plist) files. Attackers use plutil -insert to inject payload paths into LaunchAgent or LaunchDaemon plists for persistence.

Security administers macOS Keychains, keys, certificates, and the Security framework. Attackers use it to dump user passwords, export certificates, or harvest plain-text credentials.

Launchctl interfaces with launchd to manage daemons and user agents. Malware uses launchctl to immediately bootstrap and execute persistent services.

Pkgutil queries and extracts installer packages. Attackers use pkgutil --expand to decompress package payloads and extract scripts without triggering installation gatekeeper checks.

Installer runs system software installations. Attackers run installer from terminal with root privileges to deploy malicious package files silently without user prompts.

Tccutil manages the Transparency, Consent, and Control (TCC) privacy database. Attackers reset permissions for applications to force prompt re-evaluation or test TCC bypasses.

Scutil manages system configuration parameters. Attackers use it during discovery to retrieve the computer name, DNS servers, and network proxy configurations.

Networksetup configures macOS network preferences. Attackers abuse it to configure rogue HTTP web proxies or reassign DNS servers to malicious resolvers.

Sqlite3 queries SQLite databases. Attackers use it to query Chrome and Safari cookies, browsing history, and notes databases without launching browsers.

Ditto copies directories while preserving extended attributes, HFS metadata, and resource forks. Attackers use it to archive sensitive folders prior to exfiltration.

Xattr displays and modifies extended filesystem attributes. Attackers execute xattr -d com.apple.quarantine on downloaded malware to bypass Gatekeeper execution blocks.

Log queries the macOS Unified Logging System. Attackers interrogate system logs to find sensitive tokens, user activities, or cleartext credentials.

Csrutil inspects and modifies System Integrity Protection (SIP) settings. Attackers check SIP status prior to attempting kernel extensions or rootkit loading.

Hdiutil manipulates macOS disk images (DMG). Attackers attach downloaded DMG images silently (-nobrowse) to access and execute stage-2 payloads without mounting icons on the desktop.