macos community v1.0.0

mdfind

Locate files using the Spotlight database.

📋 Live Preview 
mdfind
mdfind

Sandbox: execFile · Timeout: 30s

Capabilities

reconnaissance.enumerate
discovery.enumerate
security.defenseevasion.bypass

Examples

Use mdfind to provide live updates to the number of files matching the query: A bash or zsh oneliner can cause mdfind to provide an attacker with live updates to the number of files on a system.

mdfind -live passw

Use mdfind to search for AWS Keys: Allows an attacker to query the filesystem via the CommandLine/Terminal to search for AWS keys.

mdfind 'kMDItemTextContext == AKIA || kMDItemDisplayName = *AKIA* -onlyin ~'

Use mdfind to search for apps to infect: Allows an attacker to determine if specific applications are installed and can be leveraged

set appId to do shell script "mdfind kMDItemCFBundleIdentifier = '" & bundleId & "'"

Detection

TypeRule / Indicator
other https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/mdfind_search_aws_keys Jamf Protect: Detect activity related to mdfind used to search for stored AWS keys

Documentation

mdfind to locate files on MacOS by searching a pre-built database. It is a command-line alternative to Spotlight in MacOS

References