Mac Triage:

List Users

List Users on the system

[["text", "dscl . list /Users"]]

List Groups

List Groups on the system

[["text", "dscl . list /Groups"]]

List Crontabs

List out the crontab locations

[["text", "sudo ls -la /usr/lib/cron/tabs; sudo ls -la /var/at/tabs"]]

Get Detailed Metadata About a file

Sometimes you can use this to get where a file was downloaded from

[["text", "mdls '<filePath>'"]]

Show all processes & locations

[["text", "ps aux"]]

Get all launch agents and their corresponding plist files

Obtain all launch agents and the files they originate from.

[["text", "find /System/Library/Launch* /Library/Launch* /Users/*/Library/Launch* -name '*.plist' -print -exec /usr/libexec/PlistBuddy -c \"Print Label\" {} ';'"]]