T1543.001sub-technique of T1543 Create or Modify System Process
Launch Agent
macOS2 pieces on this siteT1543.001 on attack.mitre.org
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in `/System/Library/LaunchAgents`, `/Library/LaunchAgents`, and `~/Library/LaunchAgents`.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
The evidence it leaves
Where the traces live, and what each source proves and does not.
LaunchAgents and LaunchDaemons
TCC privacy database
how MITRE says to see it
Detection of Launch Agent Creation or Modification on macOS
- Detects creation or modification of user-level Launch Agents in monitored directories using `.plist` files with suspicious `ProgramArguments` or `RunAtLoad` keys. Correlates file write activity with execution of `launchctl` or unsigned binaries invoked at login.
what reduces it
- M1022 Restrict File and Directory Permissions. Set group policies to restrict file permissions to the `~/launchagents` folder.