macOS QuickLook Cache Leaks Encrypted File Previews
macOS QuickLook caches unencrypted thumbnails and file paths of contents stored in encrypted containers and USB drives, exposing them even after unmounting.
Security researcher Wojciech Reguła, in a guest post on Objective-See, details how macOS's QuickLook feature (via the com.apple.quicklook.ThumbnailsAgent XPC service) persistently caches thumbnails and file paths of previewed files—including those stored in password-protected encrypted containers like VeraCrypt, TrueCrypt, or encrypted HFS+/APFS volumes—in a plaintext SQLite database and data file under the user's temporary directory. This caching can occur automatically simply by viewing a directory in Finder, without the user ever manually invoking a QuickLook preview, and the cached thumbnails often retain enough resolution to discern the original file's contents.
The research demonstrates that this cached data persists even after the encrypted volume is unmounted and survives across reboots, making it accessible to any code running in the user's context, forensic investigators, or an attacker/law-enforcement actor with access to a running (even if the container is unmounted) system. The same behavior extends to removable USB drives, meaning file names and thumbnails from any USB stick ever inserted into the Mac remain recorded indefinitely, which the authors note could serve as a valuable historical record for forensic investigation or surveillance implants.
The post also covers mitigation: Apple's qlmanage utility with the standard -r flag does not clear the cache, but an undocumented 'qlmanage -r cache' flag purges it immediately, and 'qlmanage -r disablecache' can persistently disable QuickLook caching by modifying the com.apple.QuickLookDaemon.plist. This is presented as a privacy/forensics issue rather than an actively exploited vulnerability, with no CVE assigned and no indication of in-the-wild abuse by threat actors.
Detection guidance
QuickLook Cache Access via qlmanage Utility
Detects execution of qlmanage utility with cache-related flags, which may indicate attempted access to or manipulation of QuickLook thumbnail cache containing file previews from encrypted volumes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: QuickLook Cache Access via qlmanage Utility
description: Detects qlmanage utility execution with cache manipulation flags (-r
cache, -r disablecache). QuickLook caches thumbnails and file paths from encrypted
containers, USB drives, and other sources in plaintext SQLite databases accessible
to user-context processes.
tags:
- attack.t1005
- attack.discovery
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /qlmanage
CommandLine|contains:
- -r cache
- -r disablecache
filter_legitimate_admin:
User|contains:
- root
- _securityagent
condition: selection and not filter_legitimate_admin
falsepositives:
- System administrators routinely clearing QuickLook cache as part of privacy/forensics
hygiene
- Legitimate privacy-focused utilities scripting cache purges
level: medium
id: 9a620837-5457-5258-a115-44e1170fdf71
status: experimental
author: Vorant
Suspicious Access to QuickLook Temporary Cache Database
Detects processes accessing or reading QuickLook SQLite cache database files in user temp directories, which contain file paths and thumbnails from encrypted volumes and USB drives. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Access to QuickLook Temporary Cache Database
description: Detects file read or access operations targeting QuickLook cache SQLite
database and related data files stored in temporary directories. These databases
persistently store thumbnails and file paths from encrypted containers, removable
drives, and other sensitive storage.
tags:
- attack.t1005
- attack.t1213
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilePath|contains:
- /var/folders/
- /tmp/
TargetFilePath|endswith:
- com.apple.QuickLookDaemon/
- .thumbnails
- .db
- .sqlite
EventType: Read
filter_quicklook_daemon:
Image|endswith: QuickLookDaemon
filter_finder:
Image|endswith: Finder
condition: selection and not (filter_quicklook_daemon or filter_finder)
falsepositives:
- System utilities performing cache maintenance or diagnostics
- Legitimate backup or disk analysis tools
level: medium
id: ab38901d-a4b8-56bc-bf4c-10696760c4d8
status: experimental
author: Vorant
Enumeration of QuickLook Cache for Encrypted Volume Artifacts
Detects processes enumerating or listing contents of QuickLook cache directories in user temporary folders, potentially to extract file paths and thumbnails from unmounted encrypted volumes or USB drives. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Enumeration of QuickLook Cache for Encrypted Volume Artifacts
description: Detects process listing or directory enumeration of QuickLook cache stored
under user temp directories. Attackers may enumerate these caches to extract file
paths and preview thumbnails from encrypted containers and removable media without
needing to mount or decrypt the original volumes.
tags:
- attack.t1005
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains:
- 'ls '
- 'find '
- 'cat '
- 'strings '
- 'sqlite3 '
filter_admin_context:
User|contains: root
condition: selection and not filter_admin_context
falsepositives:
- Security researchers or forensic analysts investigating system artifacts
- System administrators performing cache diagnostics
level: low
id: 8d8ede25-b60f-5ce4-8ca6-afb3fc3bf620
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x30.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free