macOS LOOBins: Detecting Living Off the Orchard Abuse

macOS malware rarely needs its own tools: osascript, security, sfltool and dozens of other Apple-signed binaries already do credential theft, discovery and persistence, and they are trusted by default because Apple signs and ships them. LOOBins (Living Off the Orchard: macOS Binaries) is the community catalogue of these binaries, the macOS counterpart to LOLBAS on Windows and GTFOBins on Unix. This guide explains what the LOOBins project contains, how defenders use it, which binaries matter most and how they appear in real macOS malware, and what telemetry from the Endpoint Security framework and the unified log you need to detect abuse. It is written for macOS administrators, detection engineers and threat hunters. The general concept and the Windows view are in the Living off the Land Guide; this page is macOS only.

Key takeaways

Signed does not mean safe on macOS. Built-in binaries are trusted by Gatekeeper and often by allowlists, so detection must look at arguments, parent processes and sequence, not at the file.
LOOBins is a detection catalogue. Each entry lists example abuse, the ATT&CK tactics and techniques it maps to, published detections and references, and the whole set is available as JSON.
A handful of binaries cover most real cases. osascript, security, xattr, launchctl, dscl, plutil and sqlite3 appear repeatedly in ATT&CK procedure examples for macOS stealers and backdoors.
Process execution telemetry with full arguments is the foundation. Endpoint Security framework exec events, collected by an EDR or open tool, are the main data source; the unified log fills gaps.
Prevention means reducing need. Restrict who can run scripting and admin binaries through configuration profiles, privacy permissions and standard user accounts, then alert on what remains.

What the tool does

LOOBins is an open project, maintained on GitHub with a web front end at loobins.io, that documents built-in macOS binaries an attacker can use for execution, privilege escalation, persistence, credential access and exfiltration. On 8 November 2026 the site listed 78 binaries and 263 use cases. It deliberately excludes Unix binaries already covered by GTFOBins unless there is a macOS-specific use, such as sqlite3 against privacy and quarantine databases.

Each entry is a YAML file with a consistent structure, which makes it useful to machines as well as people:

Description and paths: what the binary is for and where it lives (for example /usr/bin/sfltool).
Example use cases: named abuse scenarios, each tagged with ATT&CK tactics and technique IDs.
Detections: links to published Sigma, Elastic, Splunk and Jamf Protect analytics, or a note that none existed at publication.
Resources: man pages, research posts and incident write-ups.
API access: a JSON file of all entries and the PyLOOBins Python SDK and CLI, so you can pull the catalogue into a detection coverage tracker.

Defender use cases

The binaries that matter most

Binary	Legitimate purpose	Abuse documented in LOOBins or ATT&CK	ATT&CK technique
`osascript`	Runs AppleScript and JavaScript for Automation (JXA)	Fake password dialogs, clipboard collection, system information, running shell commands, Remote Apple Events to other Macs	T1059.002 AppleScript; T1056.002 GUI Input Capture; T1115
`security`	Keychain and certificate management	Dumping keychains, reading the browser "Safe Storage" secret, adding a trusted root for interception	T1555.001 Keychain; T1553.004 Install Root Certificate
`sfltool`	Manages the Shared File List and Background Task Management data	`dumpbtm` lists login and background items (discovery); `resetbtm` reverts them to defaults, which can wipe evidence or disrupt security agents	Discovery; Defense Impairment (TA0112)
`dscl`	Directory Services command line	Enumerating local and Active Directory users, groups, computers and shares	T1087.001; T1087.002
`plutil`	Reads and edits property lists	Setting `LSUIElement` so an app runs without a Dock icon; editing launch item plists	T1564.003 Hidden Window; T1647 Plist File Modification
`tclsh`	Tcl interpreter	Holds the `disable-library-validation` entitlement, so it can load unsigned libraries	T1129 Shared Modules
`xattr`	Extended attributes	Removing `com.apple.quarantine` to avoid Gatekeeper checks	T1553.001 Gatekeeper Bypass
`launchctl`	Controls launchd jobs	Loading persistence agents and daemons, unloading security agents	T1569.001; T1543.001; T1543.004
`tccutil`, `sqlite3`	Privacy database management, SQLite client	Resetting or editing TCC permissions and reading quarantine history	T1548.006 TCC Manipulation
`csrutil`, `spctl`	SIP and Gatekeeper status and policy	Checking or disabling System Integrity Protection and Gatekeeper	T1685 Disable or Modify Tools; T1553.001
`mdfind`	Spotlight search	Finding cloud credential files	T1552.001 Credentials In Files
`systemsetup`	System configuration	Enabling Remote Login (SSH) or Remote Apple Events	T1021.004 SSH

How they appear in real macOS malware

MITRE ATT&CK procedure examples show the pattern clearly:

Credential prompts: Cuckoo Stealer uses osascript to show a password-stealing prompt, and GlassWorm uses AppleScript to run a shell command that retrieves keychain passwords. Stealers of this kind are profiled in the Atomic macOS Stealer Guide.
Execution and persistence: ThiefQuest launches itself with osascript -e, macOS.OSAMiner calls osascript from a Launch Agent, and Dok uses AppleScript to create a login item.
Gatekeeper evasion: Cuckoo Stealer, MacMa and OSX_OCEANLOTUS.D remove the quarantine attribute with xattr; OSX/Shlayer uses spctl to disable Gatekeeper for a downloaded file when it has elevated rights.
Keychain theft: MacMa, Calisto, Proton and iKitten collect keychain data, often by copying keychain files or calling keychain APIs rather than the security binary, so file monitoring is needed as well as process monitoring.

Ways to use the catalogue

Coverage mapping: pull the JSON, list each binary and technique, and mark which ones your EDR or SIEM rules detect. Gaps become your detection backlog.
Baselining: for each high-risk binary, record which users, parent processes and management tools run it normally. Management agents and admin scripts run dscl, launchctl and security constantly.
Hunting: use the example use cases as hunt hypotheses, searching historical process data for the documented argument patterns.
Purple teaming: in an authorised test environment, have a red team reproduce documented use cases and confirm alerts fire. See the macOS Detection and Response Guide.

Deployment and safe use

LOOBins itself is reference data, so deployment is about how you consume it and who can see it.

Treat it as untrusted input: it is community-maintained. Review entries before turning them into blocking rules, and pin the version you imported so changes are reviewed.
Keep the example commands in the lab: entries include working command examples for abuse. Run them only on test Macs you own, under an authorised test plan, never on production endpoints.
Licensing and attribution: check the repository licence before redistributing entries in internal tooling, and credit the project in internal documentation.
Plan for gaps: many entries say no detection existed at publication, for example defaults, kextstat and tccutil. Do not assume vendor coverage.

Telemetry you need

Source	What it gives you	Notes
Endpoint Security framework exec events (`ES_EVENT_TYPE_NOTIFY_EXEC`; `ES_EVENT_TYPE_AUTH_EXEC` to block)	Every process execution with path, arguments, parent, signing information	Only entitled system extensions with Full Disk Access can subscribe, so you need an EDR or an open ES-based collector
ES file and Background Task Management events	Writes to LaunchAgents, keychain files and TCC databases; new login and background items	Pairs with process data to catch abuse that uses APIs instead of binaries
Unified log	Subsystem messages, TCC decisions, Gatekeeper assessments, login item changes	Query with `log show` or `log stream` and a predicate; high volume, so forward selectively
MDM inventory	SIP and Gatekeeper status, installed developer tools, admin accounts	Confirms the controls that reduce LOOBin abuse are in place

Detection and hardening value

Detection ideas

osascript with dialogs: display dialog with default answer or hidden answer, especially mentioning password or keychain, from any parent other than a known management tool.
osascript from unusual parents: launched by a recently downloaded app, a shell spawned by a browser, or AppleEventsD followed by Terminal and a shell, which LOOBins notes as a sign of Remote Apple Events execution; arguments containing eppc:// or base64 --decode.
Keychain access: Sigma's keychain rule looks for /usr/bin/security with dump-keychain, find-certificate, export or login-keychain; add find-generic-password -w and add-trusted-cert.
Quarantine removal: xattr with -d and com.apple.quarantine, outside software deployment tools.
Background task tampering: any sfltool resetbtm on a managed Mac, and dumpbtm outside support sessions.
Security control changes: spctl disabling assessments, csrutil status checks from non-admin tools, tccutil reset, and sqlite3 opening TCC.db.
Sequences over single events: discovery (dscl, system_profiler), then a credential prompt, then an archive and an outbound curl within minutes is a stealer pattern even when each step looks normal.

Hardening that reduces abuse

Standard user accounts: many LOOBin use cases need admin rights; remove local admin from daily use. See the macOS Security Guide for Enterprises.
Privacy permissions: use PPPC profiles so scripting tools cannot gain Automation, Full Disk Access or Accessibility silently. See the macOS TCC and Privacy Permissions Management Guide.
Keep SIP and Gatekeeper on and report their state through MDM; align with the macOS CIS and mSCP Compliance Guide.
Limit developer tools: Xcode Command Line Tools add compilers and interpreters; install them only for users who need them and track their presence in inventory.
Disable Remote Apple Events and Remote Login where not required, and alert on systemsetup enabling them.

Metrics

Metric	Target
High-risk LOOBins with at least one tested detection	100% of the binaries in the table above
Managed Macs sending exec events with full arguments	Above 98%
Macs with SIP and Gatekeeper enabled	100% outside documented exceptions
Users with standing local admin rights	Decreasing quarter on quarter
False positive rate on LOOBin rules after tuning	Low enough that each alert is triaged within a day

Framework mapping

Framework	Reference	Relevance
MITRE ATT&CK	T1059.002; T1555.001; T1553.001; T1543.001; T1218 System Binary Proxy Execution	Technique coverage for detection engineering
NIST SP 800-53 Rev. 5	SI-4 System Monitoring; AU-12 Audit Record Generation	Process telemetry and alerting
NIST SP 800-53 Rev. 5	CM-7 Least Functionality; AC-6 Least Privilege	Removing unneeded tools and admin rights
NIST CSF 2.0	DE.CM-09; PR.PS-01	Monitoring endpoints and applying configuration management

Alternatives

MITRE ATT&CK: the authoritative technique and procedure source; LOOBins adds binary-level examples and detection links.
GTFOBins: covers Unix binaries also present on macOS, such as shells, interpreters and file tools.
Vendor detection libraries: Sigma, Elastic, Splunk and Jamf Protect publish macOS analytics, many linked from LOOBins entries.
Application control: where your EDR supports it, block high-risk binaries for user populations that never need them, after a monitor-only period.

Common failure patterns

Collecting process names without arguments, which makes osascript, security and xattr detections impossible.
Allowlisting by signature, so every Apple-signed binary is trusted regardless of use.
Ignoring API-based theft: stealers that read keychain files directly are missed by rules that watch only the security binary.
Untuned rules on admin activity: management agents trigger dscl and launchctl rules thousands of times, and analysts start ignoring them.
Everyone is a local admin, which removes the friction that stops many LOOBin use cases.

Practitioner checklist

Confirm your EDR collects Endpoint Security exec events with full arguments and parent process on every managed Mac.
Import the LOOBins JSON and map each binary to your existing detections.
Build or tune detections for osascript dialogs, security keychain commands, xattr quarantine removal and sfltool resetbtm first.
Baseline management tool activity and exclude it narrowly by signed parent, not by binary name.
Add file monitoring for keychain files, LaunchAgents and TCC databases.
Remove standing local admin rights and deploy PPPC profiles for scripting tools.
Report SIP, Gatekeeper and developer tools status through MDM.
Test detections quarterly in an authorised lab using the documented use cases.

macOS LOOBins: Detecting Abuse of Built In Apple Binaries