Skip to main content

Summary

Read the contents of all open iTerm tabs if iTerms is open, otherwise just inform the operator that it’s not currently running
  • Needs Admin: False
  • Version: 1
  • Author: @its_a_feature_
In Mojave+ (10.14+) this will cause a popup the first time asking for permission for your process to access iTerm.

Arguments

Usage

MITRE ATT&CK Mapping

  • T1139
  • T1056

Detailed Summary

This uses AppleEvents to read the contents of iTerm tabs: