Cross-source coverage
T1543.001 / ATT&CK
Create or Modify System Process: Launch Agent
15 rules across 5 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents. Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
Launch Agents can also be executed using the Launchctl command.
Adversaries may install a new Launch Agent that executes at login by placing a.plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true. The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.
- Tactics
- Persistence · Privilege Escalation
- Platforms
- macOS
- Telemetry
-
macos:unifiedlogfs:fsusagemacos:osquery
How MITRE says to detect it DET0434
Detection of Launch Agent Creation or Modification on macOS
macOS Analytic 1208
Detects creation or modification of user-level Launch Agents in monitored directories using `.plist` files with suspicious `ProgramArguments` or `RunAtLoad` keys. Correlates file write activity with execution of `launchctl` or unsigned binaries invoked at login.
macos:unifiedloglaunchctl load or boot-time plist registrationfs:fsusagewrite or chmod to ~/Library/LaunchAgents/*.plistfs:fsusagemodification of existing LaunchAgents plistmacos:osquerydetection of new launch agents with suspicious paths or unsigned binaries
elastic/detection-rules
6 rules| Detection | Severity | Format |
|---|---|---|
| Persistence via a Hidden Plist Filename | High | Elastic TOML |
| Persistence via Suspicious Launch Agent or Launch Daemon | High | Elastic TOML |
| Creation of Hidden Launch Agent or Daemon | Medium | Elastic TOML |
| First Time Python Created a LaunchAgent or LaunchDaemon | Medium | Elastic TOML |
| Suspicious Hidden Child Process of Launchd | Medium | Elastic TOML |
| Launch Service Creation and Immediate Loading | Low | Elastic TOML |
elastic/protections-artifacts
4 rules| Detection | Severity | Format |
|---|---|---|
| Initial Access via macOS Installer Package | Undefined | Elastic TOML |
| Persistence via a Masqueraded Plist Filename | Undefined | Elastic TOML |
| Persistence via GenAI Tool | Undefined | Elastic TOML |
| Unusual Launch Service Creation via Unsigned or Untrusted Binary | Undefined | Elastic TOML |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Potential Persistence Via PlistBuddy | High | Sigma |
| Launch Agent/Daemon Execution Via Launchctl | Medium | Sigma |
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious PlistBuddy Usage | Undefined | SPL |
| Suspicious PlistBuddy Usage via OSquery | Undefined | SPL |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| mitre_attack_T1543_001_macos_launch_agent | Undefined | YARA-L |