Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
MacOSThreatTrack — Bash tool used for proactive detection of malicious activity on macOS systems. | Kitploit
Tools/GitHubGitHub/ab2pentest/macosthreattrack
Information GatheringDigital ForensicsIncident ResponseLog Analysis
GitHubab2pentest/macosthreattrack

MacOSThreatTrack

Bash tool used for proactive detection of malicious activity on macOS systems.

View Repository
393311 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

MacOS ThreatTrack v2.0

Enhanced security information gathering tool for macOS systems with advanced threat detection capabilities.

Description

MacOSThreatTrack is a comprehensive bash-based security reconnaissance tool designed for proactive detection of malicious activity on macOS systems. This enhanced version provides extensive system information gathering, threat detection capabilities, and digital forensics data collection.

Inspired by Venator-Swift and enhanced with additional security features.

Features

🔍 Enhanced Information Gathering

  • System Information: Hostname, UUID, macOS version, kernel version, processor info, memory, disk info, network interfaces, uptime, boot time, timezone
  • User Data: User lists with admin status, environment variables, last login information
  • Process Analysis: Running processes, suspicious processes, high CPU processes, network processes
  • Network Information: Active connections, listening ports, ARP table, routing table, DNS servers
  • Security Status: SIP status, GateKeeper status, FileVault status, firewall status, automatic updates

🛡️

Security & Threat Detection
  • Threat Indicators: Suspicious processes, connections, files, and network activity
  • File System Analysis: Recent files, suspicious files, large files, hidden files
  • System Logs: Error logs, authentication logs, network logs from the last hour
  • Browser Data: Safari and Chrome bookmarks, extensions analysis

📊 Output Formats

  • JSON Output: Structured data for automated analysis and integration
  • Text Output: Human-readable format for manual review
  • File Export: Save results to specified files

🔧 Enhanced Features

  • Error Handling: Robust error handling and logging
  • Verbose Logging: Detailed logging for debugging and analysis
  • Modular Design: Well-organized, maintainable code structure
  • Command Line Options: Flexible execution with various options

Installation & Usage

One-liner execution

root@kitploit:~
curl https://raw.githubusercontent.com/ab2pentest/MacOSThreatTrack/main/MacOSThreatTrack.sh | bash

Local execution

root@kitploit:~
chmod +x MacOSThreatTrack.sh
./MacOSThreatTrack.sh [OPTIONS]

Command Line Options

root@kitploit:~
Usage: MacOSThreatTrack.sh [OPTIONS]

Options:
  -j, --json          Output in JSON format (default)
  -t, --text          Output in text format
  -o, --output FILE   Save output to file
  -v, --verbose       Enable verbose logging
  -h, --help          Show help message

Examples:
  ./MacOSThreatTrack.sh                  # Run with default JSON output
  ./MacOSThreatTrack.sh -t               # Run with text output
  ./MacOSThreatTrack.sh -o report.json   # Save JSON output to file
  ./MacOSThreatTrack.sh -v -t            # Run with verbose logging and text output

Gathered Information

System Information

  • Hostname, UUID, macOS version, kernel version
  • Processor information, memory details, disk information
  • Network interfaces, uptime, boot time, timezone
  • FileVault status, firewall status

User & Security Data

  • User lists with admin status and UUIDs
  • Last login information
  • Environment variables
  • Security status (SIP, GateKeeper, FileVault, firewall)

Process & Network Analysis

  • All running processes
  • Suspicious processes (nc, netcat, curl, wget, etc.)
  • High CPU processes
  • Active network connections
  • Listening ports
  • ARP table and routing information
  • DNS server configuration

Command History & Shell Data

  • Zsh and Bash command histories for all users
  • Shell startup scripts (.bash_profile, .bashrc, .profile, .zshrc)
  • Recent command activity

System Services & Applications

  • Launch Daemons and Agents
  • Periodic scripts
  • Cron jobs
  • Installed applications
  • Installation history
  • Chrome extensions with manifest files

Digital Forensics Data

  • Recent files (last 7 days)
  • Suspicious files (.exe, .bat, .cmd, .scr)
  • Large files (>100MB)
  • Hidden files
  • System logs (errors, authentication, network)
  • Browser bookmarks (Safari, Chrome)

Threat Detection

  • Suspicious processes and connections
  • Suspicious files and network activity
  • Indicators of compromise
  • Recent network activity patterns

JSON Output Structure

root@kitploit:~
{
  "metadata": {
    "tool": "MacOSThreatTrack",
    "version": "2.0",
    "timestamp": "2024-01-01T12:00:00Z",
    "hostname": "MacBook-Pro",
    "user": "admin"
  },
  "data": {
    "system_info": { ... },
    "users": { ... },
    "processes": { ... },
    "network": { ... },
    "security": { ... },
    "command_history": { ... },
    "shell_scripts": { ... },
    "system_services": { ... },
    "applications": { ... },
    "file_system": { ... },
    "system_logs": { ... },
    "browser_data": { ... },
    "threat_indicators": { ... }
  }
}

Use Cases

  • Security Assessments: Comprehensive system security evaluation
  • Incident Response: Rapid information gathering during security incidents
  • Threat Hunting: Proactive detection of malicious activity
  • Digital Forensics: Evidence collection and analysis
  • Compliance Auditing: Security posture assessment
  • System Monitoring: Baseline establishment and change detection

Requirements

  • macOS system
  • Bash shell
  • Standard macOS utilities (system_profiler, sw_vers, sysctl, etc.)
  • Some features may require sudo privileges

Contributing

Contributions are welcome! Please feel free to submit issues, feature requests, or pull requests.

License

This project is open source and available under the MIT License.

Download Tool