Knockknock
KnockKnock is a free, open-source tool that uncovers persistently installed software on macOS, helping to generically reveal malware. It scans known locations where persistent software or malware may be installed, and provides detailed information about each item, including its hash, size, plist, and signed status. KnockKnock also integrates with VirusTotal to retrieve information about the files and allows users to submit unknown files for analysis. The tool provides a user-friendly interface to display the results, with options to filter out signed Apple and whitelisted items, and to save the findings as a JSON file. KnockKnock can also be run via the command line, allowing for programmatic deployment and execution. Overall, KnockKnock is a valuable tool for macOS users to detect and analyze persistently installed software and potential malware on their systems.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
Cortex XDR is a comprehensive endpoint security solution that blocks advanced attacks with behavioral threat protection, AI, and cloud-based analysis, and provides complete endpoint security and lightning-fast investigation and response.
Powerfully simple endpoint security solution that takes down threats without interrupting business.
Advanced Endpoint Protection is a complete endpoint protection platform that provides advanced threat protection against ransomware, data breaches, and malware.
Symantec Enterprise Cloud provides comprehensive cybersecurity for large enterprises, with a focus on data-centric hybrid security and innovation in threat and data protection.
A static analysis framework for extracting key characteristics from various file formats
A robust endpoint security solution that offers data security, network security, and advanced threat prevention, all managed from a single console to protect your devices and data.
Microsoft Defender for Endpoint is a comprehensive endpoint security solution that provides industry-leading, multi-platform detection and response capabilities.
Comprehensive endpoint security solution providing proactive defenses, remediation tools, and centralized management to prevent threats and ensure uptime.
A simple ransomware protection that intercepts and kills malicious processes attempting to delete shadow copies using vssadmin.exe.
PINNED
A cybersecurity platform that offers vulnerability scanning, Windows Defender and 3rd party AV management, and MFA compliance reporting, among other features.
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.