T1647

Plist File Modification

macOSnothing on this site yetT1647 on attack.mitre.org

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the `info.plist` file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Ransomware, suspected or confirmed

Files renamed or unreadable, a ransom note, or backup deletion commands seen.

how MITRE says to see it

Detection Strategy for Plist File Modification (T1647)

Monitor for unexpected modifications of plist files in persistence or configuration directories (e.g., ~/Library/LaunchAgents, ~/Library/Preferences, /Library/LaunchDaemons). Detect when modifications are followed by execution of new or unexpected binaries.

what reduces it

M1013 Application Developer Guidance. Ensure applications are using Apple's developer guidance which enables hardened runtime.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.