Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.
☆551Oct 18, 2026Updated 2 weeks ago
Alternatives and similar repositories for LOOBins
Users that are interested in LOOBins are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- macOS Initial Access Payload Generator☆329Jan 10, 2024Updated 2 years ago
- LOLAPPS is a compendium of applications that can be used to carry out day-to-day exploitation.☆206Feb 19, 2025Updated last year
- A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool. Author: Cedric Owens☆348Apr 28, 2022Updated 4 years ago
- Living Off The Land Drivers☆1,843Updated this week
- FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is de…☆829Apr 18, 2026Updated 6 months ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- macOS Security Research☆123Mar 15, 2024Updated 2 years ago
- This project aims to compare and evaluate the telemetry of various EDR products.☆2,001Updated this week
- "The missing ProcMon for macOS": Mac Monitor records Endpoint Security events and displays them for analysis.☆1,400Updated this week
- Take over macOS Electron apps' TCC permissions☆224Aug 12, 2023Updated 3 years ago
- A command line tool for pstree-like output on macOS with additional pid capturing capabilities☆288Oct 21, 2026Updated 2 weeks ago
- Tracking of offensive macOS tooling, blogs, and related helpful information☆195Nov 18, 2024Updated last year
- TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts☆1,413Mar 9, 2026Updated 7 months ago
- A collection of Azure AD/Entra tools for offensive and defensive security purposes☆2,753Oct 22, 2026Updated last week
- SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain.…☆962Updated this week
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods☆1,472Aug 18, 2023Updated 3 years ago
- Swift 5 macOS agent☆117Jul 23, 2024Updated 2 years ago
- Collection of macOS persistence methods and miscellaneous tools in JXA☆290Mar 26, 2026Updated 7 months ago
- A collaborative, multi-platform, red teaming framework☆4,883Oct 17, 2026Updated 2 weeks ago
- The swiss army knife of LSASS dumping☆2,144Sep 17, 2024Updated 2 years ago
- a tool to help operate in EDRs' blind spots☆777Dec 2, 2024Updated last year
- ☆258Sep 28, 2023Updated 3 years ago
- Collection of random RedTeam scripts.☆213Mar 8, 2024Updated 2 years ago
- Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)☆8,909Sep 26, 2026Updated last month
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- JavaScript for Automation (JXA) macOS agent☆108Jul 30, 2026Updated 3 months ago
- ObjectiveC CLI tool for interacting with macOS Keychain☆85Oct 10, 2022Updated 4 years ago
- A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techni…☆1,427Oct 27, 2023Updated 3 years ago
- ☆70Oct 30, 2023Updated 3 years ago
- ScareCrow - Payload creation framework designed around EDR bypass.☆2,886Aug 18, 2023Updated 3 years ago
- FindUncommonShares is a Python script allowing to quickly find uncommon shares in vast Windows Domains, and filter by READ or WRITE acces…☆438Oct 1, 2026Updated last month
- Objective-C library and console to interact with Heimdal APIs for macOS Kerberos☆157Jul 12, 2023Updated 3 years ago
- Lifetime AMSI bypass☆693Sep 26, 2023Updated 3 years ago
- KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default…☆1,689Aug 6, 2022Updated 4 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Spartacus DLL/COM Hijacking Toolkit☆1,085Feb 1, 2024Updated 2 years ago
- Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.☆489Jul 9, 2024Updated 2 years ago
- Aftermath is a free macOS IR framework☆602Sep 25, 2025Updated last year
- Custom Query list for the Bloodhound GUI based off my cheatsheet☆860Oct 29, 2025Updated last year
- A C# utility for interacting with SCCM☆707Sep 29, 2026Updated last month
- JXA and swift code that can perform some macOS situational awareness without generating TCC prompts.☆40Apr 20, 2022Updated 4 years ago
- Windows Privilege Escalation from User to Domain Admin.☆1,475Dec 18, 2022Updated 3 years ago