A command-line tool for macOS persistence mechanism emulation, designed for threat hunters and security testing.
PoisonApple is a command-line tool that allows security professionals to test and emulate various persistence mechanisms on macOS systems. It helps threat hunters understand how malware maintains access on Apple computers by simulating real-world persistence techniques. The tool provides a way to apply, test, and remove these mechanisms in a controlled environment.
Threat hunters, red teamers, security researchers, and penetration testers who need to understand and emulate macOS malware persistence techniques for security testing and threat hunting purposes.
Developers choose PoisonApple because it provides a comprehensive, easy-to-use command-line interface for testing macOS persistence mechanisms without requiring deep manual configuration. Its focus on threat emulation and inclusion of removal capabilities makes it safer and more practical for security testing than manual methods.
macOS persistence tool
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports 17+ macOS persistence mechanisms like LaunchAgents, Cron jobs, and shell configs, as detailed in the --list output, providing a wide range for testing.
Built specifically for cyber threat emulation, aiding red teams and threat hunters in realistic security testing, as emphasized in the README's philosophy.
Includes a -r flag to remove persistence mechanisms, ensuring safe testing and preventing leftover configurations, which is a key feature highlighted in the usage examples.
Allows specifying custom commands with the -c flag, enabling tailored persistence behavior for advanced scenarios, as shown in the custom command example.
Exclusively targets macOS systems, making it useless for security testing on other operating systems, which limits its applicability in heterogeneous environments.
The README explicitly warns that it will likely cause AV/EDR alerts, complicating use in monitored or production settings where false positives are a concern.
Requires careful manual setup, advised only on virtual machines, and lacks automated deployment features, making it less efficient for large-scale or repetitive testing.