macos community v1.0.0

plutil

Read, create or edit plist files.

📋 Live Preview 
plutil
plutil

Sandbox: execFile · Timeout: 30s

Capabilities

security.defenseevasion.bypass

Examples

Set app to run with dock icon hidden: plutil can be used to set the "LSUIElement" attribute to true which will force the targeted app to run without the UI and dock icon.

plutil -insert LSUIElement -string "1" /Applications/TargetApp.app/Contents/Info.plist

Detection

TypeRule / Indicator
splunk https://research.splunk.com/endpoint/c11f2b57-92c1-4cd2-b46c-064eafb833ac/ Splunk Security Content: MacOS plutil

Documentation

plutil is a command-line utility used for managing property list (.plist) files. These files are commonly used by macOS to store a app settings and other configuration info. The utility allows users to check the validity of plist files plutil -lint, convert plist files between XML and binary formats (plutil -convert), and add, modify or remove plist key value pairs.

References