PoisonApple
A command-line tool for macOS persistence mechanism emulation and testing, designed for threat hunters.
What is PoisonApple?
PoisonApple is a command-line tool that allows security professionals to test and emulate various persistence mechanisms on macOS systems. It helps threat hunters understand how malware maintains access to compromised systems by implementing techniques like LaunchAgents, cron jobs, and login hooks. The tool is designed for cyber threat emulation purposes to improve security defenses.
Security researchers, threat hunters, red teamers, and cybersecurity professionals who need to test macOS security defenses against persistence-based attacks.
PoisonApple provides a comprehensive, easy-to-use tool specifically focused on macOS persistence techniques, saving security teams time compared to manual implementation. It offers both emulation capabilities and cleanup options, making it practical for controlled security testing environments.
Overview
macOS persistence tool
Use Cases
Best For
- Testing macOS endpoint detection and response (EDR) capabilities against persistence attacks
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
