T1543.004sub-technique of T1543 Create or Modify System Process
Launch Daemon
macOS1 piece on this siteT1543.004 on attack.mitre.org
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
The evidence it leaves
Where the traces live, and what each source proves and does not.
LaunchAgents and LaunchDaemons
how MITRE says to see it
Detection Strategy for Launch Daemon Creation or Modification (macOS)
- Creation or modification of `.plist` files in /Library/LaunchDaemons/, especially those with suspicious Program or ProgramArguments paths, combined with execution activity under launchd with elevated privileges. Detectable through correlated Unified Logs, file monitoring, and process telemetry.
what reduces it
- M1018 User Account Management. Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new Launch Daemons.
- M1047 Audit. Use auditing tools capable of detecting folder permissions abuse opportunities on systems, especially reviewing changes made to folders by third-party software.