MACPERSISTENCECHECKER

Summary from the TLDR InfoSec newsletter

MacPersistenceChecker is a native macOS security tool that enumerates all persistence mechanisms across 20+ categories, including launch agents, system extensions, and BTM database entries, scoring each item 0-100 based on code signatures, LOLBins detection, and behavioral anomalies mapped to MITRE ATT&CK framework. The tool includes real-time monitoring with optional Claude AI integration that analyzes changes using full context, including risk scores and intent mismatches, plus MCP server support enabling Claude Code integration for natural language queries against persistence data. Security teams can leverage containment features to quarantine suspicious items with automatic backup and timed release.