Cross-source coverage
T1569.001 / ATT&CK
System Services: Launchctl
4 rules across 3 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.
- Tactics
- Execution
- Platforms
- macOS
- Telemetry
-
macos:unifiedlog
How MITRE says to detect it DET0265
Detection Strategy for System Services: Launchctl
macOS Analytic 0736
Abuse of launchctl to execute or manage Launch Agents and Daemons. Defender perspective: correlation of suspicious plist file creation or modification in LaunchAgents/LaunchDaemons directories with subsequent execution of the launchctl command. Abnormal executable paths (e.g., /tmp, /Shared) or launchctl activity followed by network connections are highly suspicious.
macos:unifiedlogexecution of launchctl load/unload/start commandsmacos:unifiedlogwrite of plist files in /Library/LaunchAgents or /Library/LaunchDaemonsmacos:unifiedloglaunchctl spawning new processesmacos:unifiedlogcreation or loading of new launchd services
elastic/protections-artifacts
2 rules| Detection | Severity | Format |
|---|---|---|
| Initial Access via macOS Installer Package | Undefined | Elastic TOML |
| Launchctl Submit Execution of Downloaded File | Undefined | Elastic TOML |
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| Launch Agent/Daemon Execution Via Launchctl | Medium | Sigma |
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Launch Service Creation and Immediate Loading | Low | Elastic TOML |