Installed Applications
Overview
Section titled “Overview”Evidence: Installed Applications
Description: Collect info on installed apps
Category: System
Platform: macos
Short Name: apps
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”This collector gathers installed applications information from macOS, including bundle identifiers, versions, signatures, and entitlements. This data is essential for understanding software inventory, detecting unauthorized installs, and investigating persistence.
Data Collected
Section titled “Data Collected”This collector gathers structured data about installed applications.
Installed Applications Data
Section titled “Installed Applications Data”| Field | Description | Example |
|---|---|---|
DisplayName | Display Name | Example value |
AppName | App Name | Example value |
Path | Path | Example value |
Environment | Environment | Example value |
Element | Element | Example value |
BundleExecutable | Bundle Executable | Example value |
BundleIdentifier | Bundle Identifier | Example value |
BundleName | Bundle Name | Example value |
BundleVersion | Bundle Version | Example value |
LastChangeTime | Last Change Time | 2023-10-15 14:30:25+03:00 |
AccessTime | Access Time | 2023-10-15 14:30:25+03:00 |
ModificationTime | Modification Time | 2023-10-15 14:30:25+03:00 |
LastOpenedTime | Last Opened Time | 2023-10-15 14:30:25+03:00 |
Hash | Hash | Example value |
SizeInBytes | Size In Bytes | 123 |
DisableLibraryValidation | Disable Library Validation | true |
DyldEnvVariables | Dyld Env Variables | true |
SignatureInfo | Signature Info | Example value |
DynamicLibraries | Dynamic Libraries | [] |
Collection Method
Section titled “Collection Method”This collector queries the apps table via osquery and augments results with file metadata and signature details.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it highlights installed software, execution history, and code signing state, aiding detection of malicious or untrusted apps.