LOOBins grows to 76 macOS binaries and serves every binary page as Markdown

LOOBins catalogs the built-in macOS binaries that attackers abuse, and the detections that catch them. Release 2.0.17 adds seven binaries, taking the catalog from 69 entries to 76. The site now serves every binary page as Markdown, and two weekly jobs keep its links and coverage current.

Here are the seven. dseditgroup edits Directory Services groups, dsenableroot switches on the root account, PlistBuddy edits property lists, socketfilterfw controls the firewall, kmutil manages kernel extensions, kickstart sets up Remote Desktop, and Script Editor runs AppleScript. And xattr, an existing entry, gains two use cases.

Five of the new entries list detections. dseditgroup has Sigma, Elastic and Jamf Protect rules for adding a user to the admin group. dsenableroot has Elastic and Sigma rules for enabling root. And socketfilterfw has Jamf Protect, Splunk and Sigma rules for firewall changes and firewall discovery.

PlistBuddy's rules watch launch agents. Sigma flags PlistBuddy runs aimed at a LaunchAgents path, and Elastic catches an agent that is written and loaded within 30 seconds. A second Sigma rule flags PlistBuddy started by Script Editor. Script Editor's own entry lists two behaviour signals: a launch from an applescript link followed by shell or network activity, and unexpected AppleScript afterwards.

Two entries arrive with empty detection lists. kickstart, which turns on Apple Remote Desktop, and kmutil, which loads kernel extensions, ship with no detections yet. Their pages still carry paths, use cases, tactics and references, which is enough to start writing the first rule.

On the website, every binary page now has a Markdown version, linked from the HTML page. llms.txt indexes them, one line per binary. llms-full.txt holds the whole catalog in one document, for loading into a model in a single fetch. And sitemap.xml now answers at the path crawlers check by default.

Slide text

LOOBins 2.0.17

WEBSITE

Every binary page on loobins.io now has a Markdown version

/binaries/<name>.md

Markdown twin of each binary page

/llms.txt

Index with one line per binary

/llms-full.txt

The whole catalog as one document

/sitemap.xml

Sitemap index at the default path

The site has a new look too. It used to run neon cyan and pink on a purple-black ground. Now it uses an orchard palette from the original LOOBins site and logo: leaf green, apple red and pollen yellow on graphite, over dots set in staggered rows like an orchard.

Two jobs now run every Monday. At 13:00 UTC, a link check tests every detection and resource URL, and keeps one broken-links issue open until they all resolve. An hour later, the coverage scan has Claude read two weeks of macOS threat research and propose up to five binaries or techniques the catalog lacks, each as a needs-triage issue for a maintainer.

Nothing in this release removes or renames an entry. It adds seven entries, two xattr use cases and new site pages. The gap to watch is kickstart and kmutil, the two red dots, which have no detections yet. It is all on loobins.io, with PyLOOBins 2.0.17 on PyPI. LOOBins grows to 76 macOS binaries, and every binary page now reads as Markdown.