GetFileInfo is a macOS command-line utility used to display file metadata and attributes. Adversaries can misuse it for local discovery to inspect permissions, flags and other file details during post-compromise enumeration. Defenders should watch for unusual enumeration activity, especially from user-facing or scripting processes that should not be auditing files.
What the utility does
GetFileInfo is a macOS command-line utility that reveals file metadata and attributes, which makes it useful for inspection and automation. As a LOLBin, it is also relevant because attackers can invoke trusted local tools to learn about the environment without dropping obvious custom tooling.
That dual use matters because the same output that helps a legitimate user understand a file can also help an intruder map permissions, flags, ownership clues and other attributes during post-compromise discovery. The utility itself is not the risk, but its legitimate trust and availability can make suspicious enumeration blend into normal administrative activity.
Why file metadata matters during intrusion discovery
File metadata often tells an operator more than file contents do. Attributes, visibility flags, access context and similar details can reveal where sensitive material lives, whether a file is protected, and which paths may be worth exploring next.
For defenders, the important point is that discovery often looks routine when it is staged through native utilities. A low-noise tool that simply reports file details can support broader reconnaissance, especially when it is launched repeatedly across many paths or from processes that should not normally perform systematic inventory.
In practice, the concern is not just that files are inspected, but that the inspection pattern itself may indicate post-compromise behavior. If a user-facing app, macro, script host or other unexpected process begins querying file metadata at scale, that pattern can be a sign that an adversary is building a map of the local system.
How defenders should think about exposure
Exposure is highest where endpoints allow broad interactive access, where scripting is common, and where local discovery tools are not monitored closely. Native utilities are especially valuable to adversaries when application allowlists, command-line visibility and endpoint logging do not make their use easy to distinguish from ordinary administration.
Teams should expect this technique to appear alongside other living off the land activity, not in isolation. The most useful detection lens is often the process tree and execution context, rather than the utility name alone.
NHIMG’s Living off the Land Guide is the best broader reference for understanding why trusted binaries, including file-inspection utilities, become useful to attackers.
Authoritative control mapping also helps here: NIST SP 800-53 Rev 5 Security and Privacy Controls covers the logging, access control and configuration practices that make this kind of activity more visible.
Detection and response priorities
Detection should focus on unusual execution context, repetitive file enumeration, and combinations of tooling that suggest hands-on keyboard discovery. A single metadata lookup is rarely meaningful; repeated use across many directories, or use by a process with no clear administrative purpose, is much more informative.
Response should include reviewing the parent process, command history, recent logons and any other local discovery commands that occurred around the same time. Because enumeration is often a precursor to privilege escalation, lateral movement or targeted collection, defenders should treat suspicious use of this utility as a possible early compromise indicator rather than a benign curiosity.
The ATT&CK lens is useful for organizing this behavior: MITRE ATT&CK Enterprise Matrix helps teams place trusted-utility abuse into a broader intrusion chain and align detections with observed tactics.
Risk and Threat Considerations
Trusted local tools create a low-friction discovery path for attackers because they reduce the need for custom binaries and can blend into routine administration. The main risk is not the command itself, but the attacker value of silent, native enumeration after initial access.
Failure mechanism: An adversary runs the utility from an unexpected process or script, then uses the returned metadata to identify protected files, reachable directories and other promising follow-on targets.
Impact: That reconnaissance can speed up deeper compromise, improve targeting for theft or tampering, and make malicious activity harder to distinguish from legitimate local inspection.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Logs command execution and file-access context needed to spot native utility abuse. |
| AC-6 — Least Privilege | Limits which users and processes can inspect sensitive file locations or attributes. | |
| Recommendation — Record endpoint command execution and review suspicious enumeration patterns from unexpected processes. Restrict file and directory access so enumeration reveals less to an attacker. | ||
| MITRE ATT&CK | T1218 — System Binary Proxy Execution | Trusted system utilities are commonly abused to execute or support attacker activity on endpoints. |
| Recommendation — Map trusted-utility abuse to T1218 and hunt for suspicious parent-child process chains. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Requires collecting and reviewing activity records that expose unusual local discovery behavior. |
| Recommendation — Centralize endpoint logs and review for repeated file-enumeration activity. | ||
Practitioner Guidance
What to watch for: Treat repeated metadata enumeration as suspicious when it comes from user applications, script hosts or other non-administrative processes. Correlate command-line execution with the surrounding process lineage so that normal troubleshooting does not drown out abuse patterns.
Governance implication: Make sure endpoint monitoring, allowlisting and audit policy are written to capture native-tool abuse, not only obvious malware. A mature program assumes that defenders will need to distinguish legitimate file inspection from attacker-led discovery using context, not just filenames.