KnockKnock

KnockKnock enumerates persistently installed software on a Mac and is described as AutoRuns for macOS. Malware often installs itself persistently so that it runs again after every restart, and KnockKnock shows what has set itself up that way.

It is for Mac users, administrators and security researchers who want to see what starts automatically. It lists items rather than judging them, so something appearing in the list does not mean it is malicious.

Highlights

• Lists persistently installed items grouped by category, with a count for each
• Shows whether each item is signed by Apple, signed by a third party or unsigned
• Hides Apple-signed binaries by default
• Checks binaries against VirusTotal using a hash, with the option to submit unknown items
• Shows each item's path and lets you reveal it in Finder