Installed Applications

Overview

Evidence: Installed Applications Description: Collect info on installed apps Category: System Platform: macos Short Name: apps Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

This collector gathers installed applications information from macOS, including bundle identifiers, versions, signatures, and entitlements. This data is essential for understanding software inventory, detecting unauthorized installs, and investigating persistence.

Data Collected

This collector gathers structured data about installed applications.

Installed Applications Data

Field	Description	Example
DisplayName	Display Name	Example value
AppName	App Name	Example value
Path	Path	Example value
Environment	Environment	Example value
Element	Element	Example value
BundleExecutable	Bundle Executable	Example value
BundleIdentifier	Bundle Identifier	Example value
BundleName	Bundle Name	Example value
BundleVersion	Bundle Version	Example value
LastChangeTime	Last Change Time	2023-10-15 14:30:25+03:00
AccessTime	Access Time	2023-10-15 14:30:25+03:00
ModificationTime	Modification Time	2023-10-15 14:30:25+03:00
LastOpenedTime	Last Opened Time	2023-10-15 14:30:25+03:00
Hash	Hash	Example value
SizeInBytes	Size In Bytes	123
DisableLibraryValidation	Disable Library Validation	true
DyldEnvVariables	Dyld Env Variables	true
SignatureInfo	Signature Info	Example value
DynamicLibraries	Dynamic Libraries	[]

Collection Method

This collector queries the apps table via osquery and augments results with file metadata and signature details.

Forensic Value

This evidence is crucial for forensic investigations as it highlights installed software, execution history, and code signing state, aiding detection of malicious or untrusted apps.