
Monitoring common persistence locations in real time, this free security tool alerts whenever a new launch item, login item, or similar component is added. Each alert names the responsible process and the persisted item, with code signing and VirusTotal details. Users can allow or block the change, and optional protections cover non-notarized programs, downloaded scripts, and malicious Terminal pastes.
anchor apple generic and identifier "com.objective-see.blockblock" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = VBG97UB4TA)