> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# lsopen

## Summary

Use LaunchServices API to run applications and binaries out of PID 1 (launchd). Works as a PPID spoof to evade process tree detections.

* Needs Admin: False
* Version: 1
* Author: @coolcoolnoworries

### Arguments

#### application

* Description: Path to the target application/binary
* Required Value: True
* Default Value: None

#### hideApp

* Description: If true, launch the application with the kLSLaunchAndHide flag set. If false, use the kLSLaunchDefaults flag
* Required Value: False
* Default Value: None

#### appArgs

* Description: Arguments to pass to application/binary
* Required Value: True
* Default Value: None

## Usage

```
lsopen -application "/sbin/ping" -hideApp false -appArgs 8.8.8.8 -t 47
```

## MITRE ATT\&CK Mapping

* T1036.009

## Detailed Summary

The lsopen command uses the LaunchServices API to run applications and binaries directly out of PID 1 (launchd), the macOS equivalent of explorer.exe on Windows. Where "shell" and "run" commands directly spawn processes as children, lsopen can be used as a form of PPID spoofing. This is especially helpful to evade detections built around strange process trees.

Note that application/binary output is not accessible when run through lsopen, since the parent process is no longer the poseidon payload. If the application/binary has an output argument (like nmap -o), that can be used as a workaround to this limitation.