KnockKnock
KnockKnock is a macOS security utility that scans for persistently installed software so you can review login items, launch agents, extensions, and other startup components.
What is KnockKnock?
KnockKnock is a macOS security utility for inspecting persistent software that launches automatically or stays installed in places commonly used for startup and long-term system access. It helps users audit launch agents, login items, browser extensions, authorization plugins, kernel or system extensions, cron jobs, and other persistence locations that can be relevant during malware checks or general system review. The app is aimed at security-conscious users, support staff, and anyone troubleshooting an unfamiliar Mac. Its interface highlights what was found, shows file paths and signing details, and can query VirusTotal for additional reputation information on detected items. KnockKnock also supports saving scan results and comparing scans over time, which is useful when tracking changes after installing software or investigating suspicious behavior. Objective-See, LLC publishes the app for macOS.
Key features
- Scan common macOS persistence locations for automatically launched software
- Review detected items with names, paths, signing details, and supporting metadata
- Check file reputation through integrated VirusTotal lookups
- Save scan results as JSON for later review or sharing
- Compare current and previous scans to spot added, removed, or modified items
- Open detected items in Finder for closer inspection
- Run scans from the command line for scripted or scheduled workflows
Review app leftovers with diCleaner
Inspect caches, support files, containers, and login items before cleaning.
Safety overview
Status: Mostly safe
KnockKnock is a legitimate macOS security tool whose behavior matches its purpose. It may access system locations, inspect running processes, and generate permission prompts when those processes involve protected folders such as Desktop, Downloads, or Calendar. It can also contact objective-see.org to check for updates and optionally query VirusTotal with file hashes, and user-submitted items may include file path and name details. If you use it on sensitive systems, review its VirusTotal and update-check settings before scanning.
Recommendation: Keep KnockKnock if you want an on-demand tool for checking startup persistence and investigating suspicious software on your Mac. If you do not use manual security audit tools, you can remove it without affecting normal macOS operation. Before scanning sensitive files or managed devices, adjust its network-related settings to match your privacy requirements.
Common paths
/Applications/KnockKnock.app
Share your experience
Be the first to share your experience.