knockknock ☆
« Back to VersTracker
Description:
Tool to show what is persistently installed on the computer
Type: Cask  |  Latest Version: 4.0.2@0  |  Tracked Since: Dec 17, 2025
Links: Homepage  |  @objective_see  |  formulae.brew.sh
Category: Security
Tags: security macos persistence malware analysis cli
Install: brew install --cask knockknock
About:
KnockKnock is a command-line utility that scans your Mac to identify persistently installed software, such as launch agents, browser extensions, and login items. It reveals hidden components that automatically run at startup or persist across reboots, which are often used by malware. This tool provides deep visibility into your system's persistence mechanisms, helping you uncover unwanted or malicious software.
Key Features:
  • Scans for various persistence locations including launch agents, cron jobs, and browser extensions
  • Identifies both signed and unsigned software, highlighting potential threats
  • Provides detailed information about each item, such as the originating file and signing identity
  • Command-line interface suitable for scripting and automated security checks
Use Cases:
  • Investigating potential malware infections by revealing hidden persistence mechanisms
  • Auditing a system to understand all software that launches automatically at startup
  • Security research and forensic analysis of macOS persistence techniques
Alternatives:
  • LaunchControl – A GUI tool for managing launch agents and daemons, whereas KnockKnock focuses on discovery and reporting.
  • KnockKnock-UI – A graphical version of KnockKnock for users who prefer a non-terminal interface.
Version History
Detected Version Rev Change Commit
Dec 18, 2025 7:07am 4.0.2 0 VERSION_BUMP fd304999
Dec 17, 2025 4:23am 4.0.2 0 VERSION_BUMP 4ca61c5b
Sep 15, 2025 12:33pm 3.1.0 0 VERSION_BUMP 3b80b695
Aug 5, 2025 2:20pm 3.1.0 0 VERSION_BUMP ffa918d1
« Back to VersTracker  |  Browse Packages  |  About