macos community v1.0.0

sfltool

Binary to manage the Shared File List framework.

📋 Live Preview 
sfltool
sfltool

Sandbox: execFile · Timeout: 30s

Capabilities

discovery.enumerate
security.defenseevasion.bypass

Examples

Display Login Items: Identify all current login and background items configured on the system.

sfltool dumpbtm

Reset Login Items to Defaults: Reset all third-party Login Items and revert to installation defaults.

sfltool resetbtm

Detection

TypeRule / Indicator
other https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sfltool_activity Jamf Protect: Detect attempts to dump BTM or being reverted to installation defaults

Documentation

sfltool allows interactions with the Shared File List framework, which can be used to modify application recent documents, favorites, and more.

References