4.8
KnockKnock
Like AutoRuns ...but for macOS! Contribute to objective
SHARE
Screenshots (1)
Screenshot 1 of 1
Overview
KnockKnock is an open-source macOS security inspection tool by Objective-See—known as AutoRuns for macOS. With a single click, KnockKnock recursively enumerates every persistently installed script, LaunchAgent, LaunchDaemon, Kernel Extension, Login Item, and browser plugin across your system, verifying Apple code signatures and querying VirusTotal to uncover hidden persistence malware.
How It Works
KnockKnock operates through structured, deterministic execution stages:
Multi-Vector Persistence Enumeration: Audits LaunchAgents, LaunchDaemons, Login Items, Kernel/System Extensions, BTM records, and browser plugins systematically.
Code Signature & Notarization Audit: Evaluates Apple Developer Team certificates, ad-hoc signatures, and binary notarization flags for every discovered entry.
Optional VirusTotal Threat Triage: Computes SHA-256 hashes asynchronously and queries VirusTotal multi-engine reputation scores directly in the UI.
Deterministic JSON Export & Diffing: Serializes full system persistence snapshots to clean reports for incident response and forensic comparisons.
Key Technical Features & Capabilities
Exhaustive Persistence Scanning: Inspects LaunchAgents, LaunchDaemons, System/Kernel Extensions, Cron jobs, Shell Profiles, Spotlight importers, and Login Items.
Cryptographic Signature & Notarization Checks: Displays Apple Developer Team IDs, signing validity, and Apple notarization state for every discovered binary.
Integrated VirusTotal Lookup: Automatically cross-references binary SHA-256 hashes against 70+ security engines cleanly within the dashboard.
Clean Filterable Forensic UI: Highlights unsigned binaries, unrecognized items, and command arguments for fast security triage.
Architecture & Technology Stack
Primary Languages: Objective-C, C
System Frameworks: Cocoa / AppKit, Apple Security Framework (
SecCodeCopySigningInformation), ServiceManagementIntegration: VirusTotal Public REST API (Hash-Only Lookup)
Supported Platforms: macOS 11+ (Universal Apple Silicon & Intel)
System Requirements
| Specification | Minimum Requirement | Recommended Specification |
|---|---|---|
| Operating System | macOS 11.0+ (Universal Apple Silicon & Intel) | Latest stable release build |
| Processor Architecture | 4-Core x86_64 or Apple Silicon M1 | 8-Core Apple Silicon / Core i7+ |
| Memory (RAM) | 4 GB Unified Memory | 16 GB+ High-Speed RAM |
| Disk Space | 1 GB free SSD storage | 5 GB+ free SSD storage |
Installation & Setup Guide
macOS Installation
1
Download
KnockKnock_4.1.0.zip directly from CookApps.2
Extract and move
KnockKnock.app to /Applications.3
Grant Full Disk Access in System Settings when prompted so protected persistence directories can be scanned cleanly.
Building from Source
bash
git clone https://github.com/objective-see/KnockKnock.git cd KnockKnock open KnockKnock.xcodeproj
How to Use & Workflow
1
Start Persistence Scan: Click Start Scan and allow KnockKnock to enumerate OS persistence paths.
2
Filter Non-Apple Binaries: Toggle out signed Apple OS components to focus immediately on third-party software and unknown binaries.
3
Inspect & Quarantine: Click any flagged item's plist icon, Finder link, or VirusTotal badge to audit and verify safety.
Troubleshooting & Common Issues
Issue: Scan results omit Background Task Management or LaunchAgent items.
*Cause*: macOS Transparency, Consent, and Control (TCC) protects user and system directories unless authorized.
*Resolution*: Add
KnockKnock.app under System Settings › Privacy & Security › Full Disk Access before scanning.How to Use & Getting Started
## Installation & Setup Guide
### macOS Installation
1. Download `KnockKnock_4.1.0.zip` directly from CookApps.
2. Extract and move `KnockKnock.app` to `/Applications`.
3. Grant Full Disk Access in **System Settings** when prompted so protected persistence directories can be scanned cleanly.
### Building from Source
```bash
git clone https://github.com/objective-see/KnockKnock.git
cd KnockKnock
open KnockKnock.xcodeproj
```
Ready to run KnockKnock?
100% Free & Open-Source native desktop software. Star the repository to support development.
