BlockBlock
A macOS tool that alerts you whenever software adds itself to a persistence location.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get BlockBlock
Package managers
- Homebrew
brew install --cask blockblock
About BlockBlock
Malware often installs itself persistently so it runs again after a restart or login. BlockBlock watches the common persistence locations on a Mac and alerts you whenever a new persistent component is added, so you can decide whether to allow it.
It uses Apple's Endpoint Security Framework, which means it needs system privileges and Full Disk Access during setup. Optional additional protections can be turned on at install time or later from the settings.
Strengths
- Real-time alerts for new launch items and other persistence
- Built on Apple's Endpoint Security Framework
- Published SHA-256 hashes for downloads
Limitations
- macOS only, version 10.15 or later
- Requires Full Disk Access and admin authorization
- Alerts need some knowledge to judge correctly
Details
- Pricing
- FreeFree, with source code published on GitHub.
- License
- Open source, license not stated
- Developer
- Objective-See
- Platforms
- macOS
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Mac users who want to know when something installs itself to run at login
- Categories
- Security tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to BlockBlock
Compare allSoftware that can replace BlockBlock for an important use case, and what changes if you switch.
KnockKnock
Lists the software configured to persist on a Mac.
KnockKnock lists software configured to persist on a Mac and cross-checks it against VirusTotal, reporting rather than alerting in real time.
Santa
A binary and file access authorization system for macOS that allows or blocks executables.
Santa is a macOS binary authorization system that allows or blocks executables, aimed at managed fleets.
RansomWhere?
A macOS utility that detects processes encrypting files like ransomware and stops them for review.
RansomWhere? detects processes encrypting files like ransomware and stops them for review, a behavioural guard rather than a persistence monitor.
OverSight
Receive macOS alerts about microphone and camera activity.
OverSight alerts on macOS microphone and camera activity rather than watching persistence locations.
Similar software
Related functionality, not necessarily a direct replacement.
LuLu
Control outbound application connections on macOS.
TaskExplorer
macOS tool that inspects running processes, their libraries, files and network connections.
Little Snitch
macOS application firewall that prompts on outgoing connections.
