A command-line tool for macOS persistence mechanism emulation and testing, designed for threat hunters.
PoisonApple is a command-line tool that allows security professionals to test and emulate various persistence mechanisms on macOS systems. It helps threat hunters understand how malware maintains access to compromised systems by implementing techniques like LaunchAgents, cron jobs, and login hooks. The tool is designed for cyber threat emulation purposes to improve security defenses.
Security researchers, threat hunters, red teamers, and cybersecurity professionals who need to test macOS security defenses against persistence-based attacks.
PoisonApple provides a comprehensive, easy-to-use tool specifically focused on macOS persistence techniques, saving security teams time compared to manual implementation. It offers both emulation capabilities and cleanup options, making it practical for controlled security testing environments.
macOS persistence tool
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports 17+ macOS persistence mechanisms like LaunchAgents, cron jobs, and login hooks, as shown in the --list output, providing a wide range for testing.
Includes a -r flag to remove persistence mechanisms, ensuring safe and reversible testing without manual intervention.
Allows specifying custom commands with -c, or defaults to writing timestamped entries to a Desktop file for verification, as demonstrated in the usage examples.
Designed specifically for cyber threat emulation, with references to resources like 'The Art of Mac Malware' for in-depth learning.
Only works on macOS, making it useless for testing persistence on other operating systems, which limits its applicability in mixed environments.
The README explicitly warns it will likely cause AV/EDR alerts, which can be disruptive or unacceptable in tightly monitored security setups.
Depends on Python 3.6+ and lacks built-in safeguards; users must manually ensure safe usage on virtual machines, as advised in the notes.