Persistence via a Hidden Plist Filename via macOS Security Events

  1[metadata]
  2creation_date = "2026/09/22"
  3integration = ["macos"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the registration of a launch agent or launch daemon whose property list (plist) filename begins with a dot,
 11using launch item registration messages collected by the macOS Security Events integration. An adversary may establish
 12persistence by installing a launch agent or daemon that executes at login or boot; plist files with filenames starting
 13with a dot are hidden from default directory listings and are particularly suspicious.
 14"""
 15from = "now-9m"
 16language = "esql"
 17license = "Elastic License v2"
 18name = "Persistence via a Hidden Plist Filename via macOS Security Events"
 19note = """## Triage and analysis
 20
 21> **Disclaimer**:
 22> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 23
 24### Investigating Persistence via a Hidden Plist Filename via macOS Security Events
 25
 26On macOS, launch agents and launch daemons provide persistence by running a program defined in a property list (plist) file located in a LaunchAgents or LaunchDaemons directory. When a launch item is registered, the BackgroundTaskManagement subsystem logs its path, type, and target executable to the unified log. Adversaries name the plist with a leading dot (for example `.com.evil.agent.plist`) so it is hidden from default directory listings while still functioning as persistence. This rule alerts when a registered launch item's plist filename begins with a dot, and reports the plist path, item type, and target executable extracted from the message.
 27
 28### Possible investigation steps
 29
 30- Review `Esql.plist_path`, `Esql.item_type`, and `Esql.executable` in the alert to identify the hidden plist, whether it is a launch agent (per-user) or launch daemon (system-wide), and what it runs.
 31- Retrieve and examine the plist and its target executable on the host. Determine whether the program is signed, where it is located, and what it does; executables in user-writable or temporary locations are higher risk.
 32- Determine how and when the plist was created, and by which process, using Elastic Defend file telemetry if available.
 33- Check whether the label or filename masquerades as a legitimate Apple or vendor service.
 34- Review other alerts and activity for the host and associated user during the same period.
 35
 36### False positive analysis
 37
 38- Some legitimate software and management tooling create dot-prefixed plists as part of atomic file writes or internal bookkeeping.
 39- Verify the executable and signing status before escalating; recurring benign cases can be excluded by plist path or executable.
 40
 41### Response and remediation
 42
 43- If the launch item is not legitimate, unload it with `launchctl bootout` and remove the plist, then remove or quarantine the target executable.
 44- Investigate the host for related persistence, the initial access vector, and any activity performed by the launch item's program.
 45- Reset credentials for the affected user and review the host for additional compromise.
 46- Escalate to the security operations team if additional hosts show similar patterns.
 47"""
 48references = [
 49    "https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/",
 50    "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
 51]
 52risk_score = 47
 53rule_id = "fdff275f-83c2-4857-bedf-aee88f3442ed"
 54setup = """## Setup
 55
 56This rule requires data from the macOS Security Events integration.
 57Integration setup instructions: [macOS Security Events Integration for Elastic](https://www.elastic.co/docs/reference/integrations/macos)
 58"""
 59severity = "medium"
 60tags = [
 61    "OS: macOS",
 62    "Use Case: Threat Detection",
 63    "Tactic: Persistence",
 64    "Tactic: Defense Evasion",
 65    "Data Source: macOS Security Events",
 66    "Resources: Investigation Guide",
 67    "Rule Type: ESQL",
 68    "Platform: macOS",
 69    "Domain: Endpoint",
 70]
 71timestamp_override = "event.ingested"
 72type = "esql"
 73query = '''
 74FROM logs-macos.process_execution_monitoring-* metadata _id, _version, _index
 75| WHERE data_stream.dataset == "macos.process_execution_monitoring" and
 76    macos.event.message.description LIKE "*effectiveItemDisposition*" and
 77    (macos.event.message.description LIKE "*url=file://*/Library/LaunchAgents/.*" or
 78        macos.event.message.description LIKE "*url=file://*/Library/LaunchDaemons/.*")
 79| GROK macos.event.message.description "url=file://%{DATA:Esql.plist_path}, config"
 80| GROK macos.event.message.description "type=%{DATA:Esql.item_type},"
 81| GROK macos.event.message.description "BTMConfigExecutablePath = \"%{DATA:Esql.executable}\""
 82| WHERE Esql.plist_path RLIKE ".*/Library/Launch(Agents|Daemons)/\\..*\\.plist"
 83| KEEP _id, _version, _index, @timestamp, host.name, Esql.plist_path, Esql.item_type, Esql.executable, macos.event.message.description
 84'''
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88
 89[[rule.threat.technique]]
 90id = "T1547"
 91name = "Boot or Logon Autostart Execution"
 92reference = "https://attack.mitre.org/techniques/T1547/"
 93
 94[[rule.threat.technique.subtechnique]]
 95id = "T1547.011"
 96name = "Plist Modification"
 97reference = "https://attack.mitre.org/techniques/T1547/011/"
 98
 99[[rule.threat.technique]]
100id = "T1543"
101name = "Create or Modify System Process"
102reference = "https://attack.mitre.org/techniques/T1543/"
103
104[[rule.threat.technique.subtechnique]]
105id = "T1543.001"
106name = "Launch Agent"
107reference = "https://attack.mitre.org/techniques/T1543/001/"
108
109[[rule.threat.technique.subtechnique]]
110id = "T1543.004"
111name = "Launch Daemon"
112reference = "https://attack.mitre.org/techniques/T1543/004/"
113
114[rule.threat.tactic]
115id = "TA0003"
116name = "Persistence"
117reference = "https://attack.mitre.org/tactics/TA0003/"
118
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121
122[[rule.threat.technique]]
123id = "T1564"
124name = "Hide Artifacts"
125reference = "https://attack.mitre.org/techniques/T1564/"
126
127[[rule.threat.technique.subtechnique]]
128id = "T1564.001"
129name = "Hidden Files and Directories"
130reference = "https://attack.mitre.org/techniques/T1564/001/"
131
132[rule.threat.tactic]
133id = "TA0005"
134name = "Defense Evasion"
135reference = "https://attack.mitre.org/tactics/TA0005/"