KnockKnock

Enumerates every mechanism something can use to start itself, and checks each against VirusTotal.

What it does

Malware on macOS has to persist somehow, and there are a limited number of places to do it. KnockKnock, from Objective-See, enumerates them all: launch agents and daemons, login items, kernel and system extensions, browser extensions, cron jobs, dylib insertions, authorization plugins, Spotlight importers, QuickLook plugins and more.

Each item is shown with its signing status and can be checked against VirusTotal, so the output separates “signed by Apple”, “signed by a developer you installed” and “unsigned binary in a temp directory”.

Notes

Free and open source. Objective-See’s other tools — BlockBlock, LuLu, Oversight — cover the monitoring side of the same question.
It reports, it does not remove. Removal is a separate, deliberate step.
Expect a long list on a machine with this much installed. Most of it is legitimate; the value is that anything unexpected stands out.

Alternative to

Alternative	Type	Trade-off
BlockBlock	Open source	The same developer’s real-time version: it alerts as something installs persistence
LuLu	Open source	Also Objective-See, an outbound firewall rather than a persistence auditor
`launchctl list` and `launchctl print-disabled`	Built in	Part of the same picture, built in
Malwarebytes or CleanMyMac’s malware module	Freemium / Paid	Signature-based scanning rather than enumeration