KnockKnock

About

KnockKnock reveals software that is persistently installed on your Mac. Malware often installs itself persistently so it is automatically re-executed each time the computer restarts, and KnockKnock uncovers these persistent items to generically reveal such malware. It supports macOS 10.15 and later. There is nothing to install: download the zip archive, unzip it if needed, and double-click KnockKnock.app to begin a scan. The app may ask for Full Disk Access so it can scan your entire computer, and you can optionally provide a VirusTotal API key to check for known malware.

When you press 'Start Scan,' KnockKnock lists persistent software from the locations where it may be installed, organized by category. Each item shows an icon indicating whether it is Apple-signed, third-party signed, or unsigned, along with its path and buttons for VirusTotal results, detailed information, and viewing the item in Finder. Items can also be viewed as the contents of a property list when they are persisted that way. Listed items are not automatically malicious, since legitimate third-party software also appears. Items signed by Apple are generally safe to ignore, though scripts persisted via Apple interpreters such as bash or Python should be closely examined.

For executable binaries, KnockKnock automatically queries VirusTotal using the file's hash. Known malware is highlighted in red, while unknown items display a '?', which can be submitted to VirusTotal for analysis. At the end of a scan, you can view and submit all unknown items at once. KnockKnock's settings can be accessed from the Settings icon at the bottom left of the main window.