Objective-See Foundation

LuLu. LuLu is the free open-source macOS firewall

BlockBlock. BlockBlock provides continual protection by monitoring persistence locations.

KnockKnock. Like AutoRuns ...but for macOS!

Malware. macOS Malware Collection

OverSight. OverSight monitors a mac's mic and webcam, alerting the user when the internal mic is activated, or whenever a process accesses the webcam.

ProcessMonitor. Process Monitor Library (based on Apple's new Endpoint Security Framework)

ProcInfo. process info/monitoring library for macOS

Netiquette. Network Monitor

FileMonitor. File Monitor Library (based on Apple's new Endpoint Security Framework)

WhatsYourSign. WhatsYourSign adds a menu item to Finder.app. Simply right-, or control-click on any file to display its cryptographic signing information!

ReiKey. Malware and other applications may install persistent keyboard "event taps" to intercept your keystrokes. ReiKey can scan, detect, and monitor for such taps!

DoNotDisturb. Detect Evil Maid Attacks

sniffMK. sniff mouse and keyboard events

DNSMonitor. A DNS Monitor, leveraging Apple's NEDNSProxyProvider/Network Extension Framework

AuRevoir. View and remove notification messages from Apple's "Notification Database"

DumpBTM. And open-source version of % sfltool dumpbtm

TaskExplorer. Visually explore all running tasks (processes) ....viewing its signature status, loaded dylibs, open files, network connection, and much more.

RansomWhere. Generic ransomware detector

DylibHijackScanner. Scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked.

KextViewr. View all modules on that are loaded in the OS kernel

fromAppStore. checks if an application is pristine (untampered) and from the official Mac App Store

TAOMM. The Art of Mac Malware

ProcInfoExample. example project, utilizing Proc Info library

blackhat-arsenal-tools. Official Black Hat Arsenal Security Tools Repository

objective-see.

Mach-O. A (basic) Mach-O Library

LockDown. Audits and remediates security configuration settings (El Capitan)

products. Objective-See's Products

Ostiarius. Blocks unsigned internet binaries from executing (El Capitan)