macOS host logs

Quick pivots for macOS Unified Logging and persistence locations.

Recent authentication messages

log show --last 1h --predicate 'eventMessage CONTAINS[c] "authentication"'

Process execution messages

log show --last 1h --predicate 'processImagePath != nil'

Launch agents

find ~/Library/LaunchAgents /Library/LaunchAgents -name '*.plist' -print 2>/dev/null

Launch daemons

find /Library/LaunchDaemons -name '*.plist' -print 2>/dev/null

Open network connections

lsof -nP -iTCP -sTCP:ESTABLISHED