A practical DFIR cheatsheet for identifying, collecting, triaging, and reviewing macOS persistence mechanisms, with acquisition-aware guidance for disk artifacts, live state, required privilege, triggers, and review pivots.
☆23Apr 26, 2026Updated 2 months ago
Alternatives and similar repositories for macOS-persistence-cheatsheet
Users that are interested in macOS-persistence-cheatsheet are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Outil de triage automatisé de différents types de collectes d'artefacts.☆18Dec 8, 2025Updated 7 months ago
- An implementation of EndpointSecurity on the 5BSD kernel.☆16May 31, 2026Updated last month
- ☆22Jan 7, 2026Updated 6 months ago
- A comprehensive set of tools, scripts, and resources designed for MacAdmins to efficiently manage and deploy browsers on macOS.☆21Updated this week
- Parser for Sdba memory pool tags☆21Jul 16, 2021Updated 4 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR☆46Apr 13, 2026Updated 3 months ago
- Track Apple software update changes with Github Actions☆27Feb 11, 2022Updated 4 years ago
- ☆19Oct 2, 2024Updated last year
- All the pieces needed to create a Jamf Pre Stage Package and Enrolment script displaying progress with swiftDialog☆41Apr 19, 2023Updated 3 years ago
- JXA implementation of some SwiftBelt functions. Author: Cedric Owens☆46Jun 22, 2023Updated 3 years ago
- AutoPkg Wizard - a macOS SwiftUI app for managing AutoPkg☆38Jun 25, 2026Updated 2 weeks ago
- ☆30Feb 12, 2026Updated 5 months ago
- A malware scanner with Yara and ClamAV binding☆12May 23, 2026Updated last month
- A ruleset to find potentially malicious code in macOS malware samples☆40Aug 29, 2023Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A MDM Agnostic Self Service Agent for macOS☆24Dec 7, 2024Updated last year
- An app to create app icons using SF Symbols☆33Mar 20, 2026Updated 3 months ago
- This tool is meant to parse an NTFS $MFT file.☆15Mar 26, 2024Updated 2 years ago
- Yara rules written by me, for free use.☆20Nov 26, 2021Updated 4 years ago
- App to redeploy the Jamf Framework to a device enrolled in Jamf Pro☆69Aug 16, 2024Updated last year
- A collection of tools, scripts, and resources for macAdmins to manage and deploy Microsoft updates on macOS, including patches for Office…☆296Updated this week
- Browser extension blocking scam and phishing pages https://chromewebstore.google.com/detail/nehboro/ljgklnaofelbcnegjniagpmjknkmaiom☆15Apr 22, 2026Updated 2 months ago
- #Entra #JamfPro☆10Apr 9, 2024Updated 2 years ago
- A collection of Apple-related CTF writeups☆16Jan 17, 2022Updated 4 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their ori…☆13May 10, 2023Updated 3 years ago
- Welcome to the Pressidium® Yara Rules repository. This section contains a carefully curated collection of Yara rules specifically designe…☆19Nov 5, 2023Updated 2 years ago
- NSKeyedArchive plist deserializer☆28Sep 13, 2024Updated last year
- A MacAdmin-focused QuickLook plugin with GitOps in mind☆172Jun 21, 2026Updated 3 weeks ago
- Contour — device management configuration toolkit☆61Jun 24, 2026Updated 2 weeks ago
- SharpDPAPI ported to Cobalt Strike BOFs — 19 self-contained BOFs for DPAPI credential triage☆16Feb 24, 2026Updated 4 months ago
- RedAudit is a next-generation Windows forensic and security assessment framework featuring a live cyber-operations GUI built for real inv…☆36Nov 15, 2025Updated 7 months ago
- Scripts to use with the awesome swiftDialog app https://github.com/swiftdialog/swiftdialog☆47Nov 14, 2025Updated 8 months ago
- Script to provision devices using swiftDialog☆15Dec 10, 2024Updated last year
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- brewpkg☆18Sep 30, 2025Updated 9 months ago
- Glass Cage is a zero-click PNG-based RCE chain in iOS 18.2.1, bypassing LockDown mode protection by exploiting ImageIO (CVE-2025-43300), …☆39Jan 11, 2026Updated 6 months ago
- Run Sigma detection rules on logs from the new MacOS EndpointSecurity Framework☆22Jan 22, 2021Updated 5 years ago
- Mac Saver Builder is a simple macOS app that lets you create custom screensavers by adding your own videos and thumbnails.☆42Jan 30, 2026Updated 5 months ago
- Repository to track community hardware, data and funding.☆12Apr 8, 2022Updated 4 years ago
- DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret …☆295Jun 6, 2026Updated last month
- ☆10Dec 18, 2023Updated 2 years ago