Check which software is persistently installed on a Mac with KnockKnock, a tool for inspecting startup items.
BlockBlock
BlockBlock monitors for malware that installs itself persistently to run automatically after a restart or login.
About BlockBlock
BlockBlock monitors common macOS persistence locations and alerts when a new persistent component is added. It starts automatically after restart and shows the responsible process with its name, PID, path, arguments, code signing information, process ancestry, and links to VirusTotal results for the process and persisted item. Users can allow or block each item, with decisions saved as rules that can be viewed or deleted. It requires macOS 10.15 or later, system privileges, and Full Disk Access, and offers optional notarization, script-blocking, and paste protection modes.
Key features
- Monitors common macOS persistence locations for new components
- Alerts with process name, PID, path, and arguments
- Shows code signing info and process ancestry in alerts
- Links responsible process and persisted item to VirusTotal
- Allow or block persistence with remembered rules
- Optional notarization, script-blocking, and paste protection modes
Best for: Mac users who want to review software that sets itself to run automatically after restart or login.
Good for
- Runs automatically after restart to keep monitoring
- Alerts include process details and VirusTotal links to aid review
- Allow and block decisions can be saved as manageable rules
Watch out for
- Requires system privileges and Full Disk Access to function
- Requires macOS 10.15 or later
- Notarization allow or block responses are not saved across reboots
BlockBlock at a glance
- Category
- Privacy & Security › Desktop & OS Privacy
- Type
- Website
- Pricing
- Not confirmed. Check the site
- Platforms
- macOS, Web
- Open source
- Not stated
- Last checked
- Oct 5, 2026 · Online when checked
- Listed
- Oct 5, 2026
BlockBlock alternatives
Tools and sites you could use instead, ranked by how closely they match.
Monitor and control outgoing network connections on macOS with LuLu, a free, open-source firewall.
Detect possible macOS ransomware by monitoring file encryption activity with RansomWhere?.
Tracee monitors runtime security events and supports forensic analysis with eBPF instrumentation.
Tunnelblick is free, open-source macOS software for controlling OpenVPN connections, with downloads and support information on its site.
The MailTrackerBlocker extension for macOS Apple Mail blocks email trackers, read receipts, and tracking pixels.
Popular in Desktop & OS Privacy
Well-known listings from the same topic.
wBlockapps.apple.com/app/wblock/id6746388723uBO Lite Safariapps.apple.com/app/ublock-origin-lite/id674534…Stayapps.apple.com/app/stay-for-safari/id1591620171Lockdown Privacylockdownprivacy.comTor Browsertorproject.orgFirejailfirejail.wordpress.com
BlockBlock FAQ
What happens if I click Block in an alert?
BlockBlock removes the item from the file system to block the persistence and creates a rule to remember the choice unless 'temporarily' is selected.
How do I uninstall BlockBlock?
Click 'Uninstall BlockBlock' in BlockBlock's status bar menu, then click 'Uninstall' in the uninstaller.
Where are alert responses recorded?
All alert responses are logged to /Library/Objective-See/BlockBlock/BlockBlock.log.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.