mdfind is a macOS command-line tool for searching Spotlight metadata. It can be used by attackers to discover files, documents, and artefacts on a host without dropping custom tooling. Defenders should watch for unusual query patterns, especially during reconnaissance or post-compromise activity, and correlate searches with other enumeration commands and user context.
What mdfind Does in macOS Reconnaissance
mdfind is a built-in Spotlight search utility, so it can reveal files and metadata already indexed on the host without introducing new binaries. That makes it useful for legitimate troubleshooting, but also attractive for reconnaissance because it can surface user documents, application artefacts, and other indexed content quietly.
As a living-off-the-land binary, Living off the Land Guide helps place mdfind in the broader class of native tools that defenders should expect to see abused when attackers prefer low-friction execution over custom malware.
Why mdfind Is Valuable to Attackers
Spotlight metadata can expose a lot more than filenames. Search terms may help an intruder map where sensitive material lives, infer project names, find recently used documents, or locate artefacts tied to software, cloud sync clients, or local admin activity. Because the tool is native to macOS, its use often blends into normal administrative or user behaviour.
The main danger is not the command itself, but the efficiency of the discovery it enables. A single search can shortcut manual browsing and reveal high-value locations that support follow-on actions such as theft, staging, or privilege escalation. On a compromised Mac, that makes search activity an early indicator of hands-on-keyboard reconnaissance.
How Defenders Interpret mdfind Activity
Defenders should look at query intent, timing, and context rather than the command in isolation. Searches that target broad document categories, path fragments, application names, credential-related artefacts, or unusual terms during interactive sessions deserve more scrutiny than routine user searches.
mdfind is most useful for hunting when correlated with adjacent behaviour such as shell history, process execution, archive creation, browser access, or other enumeration commands. The presence of multiple native discovery utilities in a short window often indicates a human operator or script exploring the host after initial access.
Reducing Exposure to Native Search Abuse
Hardening macOS against this pattern is mostly about limiting what an intruder can learn after landing. Reduce the amount of sensitive content that is indexed where possible, restrict local access to high-value data, and use endpoint telemetry to distinguish normal user search habits from reconnaissance-like bursts.
When defenders understand what legitimate Spotlight use looks like in their environment, mdfind becomes easier to interpret as either routine administration or a low-noise discovery step in an attack chain. In practice, the security question is not whether the tool exists, but whether your monitoring can separate ordinary search from post-compromise enumeration.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1083 — File and Directory Discovery | mdfind is used to discover files and artefacts during host reconnaissance. |
| T1057 — Process Discovery | Spotlight queries often accompany broader local discovery and hands-on-keyboard recon activity. | |
| Recommendation — Map mdfind-like searches to file discovery and hunt for unusual enumeration on endpoints. Correlate mdfind with other discovery commands to identify interactive reconnaissance. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection depends on collecting and reviewing endpoint command execution and user activity. |
| Recommendation — Log and review macOS command execution so native discovery activity is visible to defenders. | ||