KnockKnock for MAC
Free, open-source security scanner for Mac: see what is persistently installed on your computer and uncover software that starts by itself, such as malware.
KnockKnock Overview
KnockKnock is a free, open-source Mac security tool that shows what is persistently installed on your computer. Malware usually installs itself so that it runs again each time the Mac restarts, and KnockKnock uncovers software that has done this, whatever its name. Press Start Scan and it goes through the known places where such software can hide, then lists what it found by category, with the number of items in each.
Each item shows its name, its full path and an icon saying whether it belongs to Apple, is signed by a third party, or is unsigned. KnockKnock can check executable files against VirusTotal using a hash of the file, which needs a VirusTotal API key, and it can submit unknown items for analysis. Nothing needs to be installed: run the app from anywhere and delete it when you are done. It may ask for Full Disk Access so that it can scan the whole computer.
KnockKnock only lists what it finds. Legitimate third-party software appears too, so an item in the list is not necessarily malware. It comes from Objective-See and is licensed under GPL-3.0. Version 4.1.0 adds macOS 27 compatibility and an option to always run as root. It needs macOS 10.15 or later and is a universal app for Apple Silicon and Intel Macs.
Key Features
KnockKnock answers one question: what on this Mac starts by itself?
- Persistence scan: checks the known locations for persistent software.
- Categories: items are grouped and counted by type on the left.
- Signature icons: Apple, signed third party or unsigned at a glance.
- VirusTotal: shows a detection ratio for executable files.
- Submissions: send unknown items to VirusTotal for analysis.
- Apple filter: signed Apple binaries are hidden by default.
- File details: see information on an item or show it in Finder.
- No installation: run it from anywhere, delete it to remove it.
What’s New in Version 4.1.0
KnockKnock 4.1.0 brings macOS 27 compatibility, hardening and root support.
- New "always run as root" preference
- Full Disk Access detection fixed on macOS 27
- Hardening against malformed plist and JSON input, plus an improved Mach-O parser
- Launchd: reads the live override database and fixes inverted enable and disable logic
- Better enumeration of launch items, cron jobs, dylib inserts and browser extensions
- Better VirusTotal API key handling, and remaining lookups are skipped once the quota is used up
KnockKnock FAQ
Is KnockKnock free?
Yes. KnockKnock is free and open source under the GPL-3.0 licence.
What does KnockKnock do?
It scans the known places where software can install itself persistently and lists what it finds, so that you can spot malware that starts by itself.
Does an item in KnockKnock mean I have malware?
No. KnockKnock simply lists persistently installed software, and legitimate third-party software appears as well. Signed Apple binaries are filtered out by default.
Which macOS version does KnockKnock need?
Version 4.1.0 needs macOS 10.15 or later.
Does KnockKnock run on Apple Silicon?
Yes. The app is universal and runs natively on Apple Silicon and Intel Macs.
Why does KnockKnock ask for Full Disk Access?
It may ask for Full Disk Access so that it can scan your entire computer. You turn this on in System Settings.
Do I need a VirusTotal account?
The VirusTotal checks need an API key, which you can enter during setup. Objective-See’s page explains how to get a free personal key.
Do I have to install KnockKnock?
No. It runs from anywhere after you unzip it. To remove it, delete the app.
Can I install KnockKnock with Homebrew?
Yes. The Homebrew cask is called knockknock.
Where does the KnockKnock download on knockknock.FULLMAC.app come from?
The download button leads to the official KnockKnock page at https://objective-see.org/products/knockknock.html. knockknock.FULLMAC.app does not change or repackage the app.
Similar Apps
ClearanceKitClearanceKit is a free, open-source tool that controls which programs on your Mac may touch your sensitive files. It uses Apple's Endpoint Security framework to watch file-system events such as opens, renames, deletions, copies and directory reads, and blocks any process that accesses a protected path without an explicit allow rule. It is aimed at developer machines, where an unsandboxed npm, pip or brew install script runs with your full permissions and could otherwise read folders such as ~/.ssh, cloud credentials or browser cookies.Security
MakLockMakLock is a lightweight menu bar app that protects your macOS applications with Touch ID, Apple Watch proximity or a backup password. When someone tries to open or switch to a protected app, MakLock blocks access with a full-screen blur overlay on all your monitors and asks for authentication. It watches for app switches as well as launches, so returning to an app that is already running also needs unlocking.Security
ExifCleanerExifCleaner removes hidden metadata from images, media files and PDFs, such as the GPS location, camera details and dates that photos often carry. Drag and drop files or whole folders onto the window and it cleans them in a fast batch, using ExifTool behind the scenes. You can expand any processed file to see exactly what was removed, before and after.Security
Pareto SecurityPareto Security helps you keep up basic security on your Mac. It lives in the menu bar and regularly checks common settings that are easy to forget: whether FileVault disk encryption is on, the firewall is enabled, automatic login is off, Gatekeeper is active, the screen locks automatically and your apps are kept up to date. When something is off, it gently reminds you to fix it. The idea behind the name is the Pareto principle: take care of the 20% of security tasks that prevent 80% of problems.Security
LuLuLuLu is a free, open-source firewall for Mac. Almost every app connects to the internet, and so does malware; LuLu watches outgoing network connections and asks you whenever a program it doesn't know tries to connect, so you can allow it or block it. Your decisions become rules, and LuLu applies them from then on. LuLu is made by Objective-See, a non-profit foundation for Mac security tools, and is released under the GPL-3.0 license.Security- Little SnitchLittle Snitch shows you where your Mac connects to on the internet and lets you decide what is allowed. Whenever an app wants to connect, a connection alert asks you to allow or deny it, so no data leaves your Mac without your consent. Its Network Monitor shows all connections in real time, on a world map and in a traffic chart, grouped by app, domain or country. Little Snitch is made by Objective Development and has been protecting Macs for more than 20 years.Security
More from Objective-See
FULLMAC.app does not host this app. Download buttons lead to the developer’s own pages.