T1569.001sub-technique of T1569 System Services
Launchctl
macOSnothing on this site yetT1569.001 on attack.mitre.org
Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: `launchctl load`,`launchctl unload`, and `launchctl start`.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detection Strategy for System Services: Launchctl
- Abuse of launchctl to execute or manage Launch Agents and Daemons. Defender perspective: correlation of suspicious plist file creation or modification in LaunchAgents/LaunchDaemons directories with subsequent execution of the launchctl command.
what reduces it
- M1018 User Account Management. Prevent users from installing their own launch agents or launch daemons.