Launch Item Registration with Suspicious Executable Path via macOS Security Events

  1[metadata]
  2creation_date = "2026/09/22"
  3integration = ["macos"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the registration of a launch agent or launch daemon whose target executable resides in a temporary or
 11user-writable location, using launch item registration messages collected by the macOS Security Events integration.
 12An adversary may establish persistence with a launch agent or daemon that runs a program staged in a world-writable
 13or temporary directory, which is uncommon for legitimate software.
 14"""
 15from = "now-9m"
 16language = "esql"
 17license = "Elastic License v2"
 18name = "Launch Item Registration with Suspicious Executable Path via macOS Security Events"
 19note = """## Triage and analysis
 20
 21> **Disclaimer**:
 22> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 23
 24### Investigating Launch Item Registration with Suspicious Executable Path via macOS Security Events
 25
 26On macOS, launch agents and launch daemons run a program defined in their property list (plist). When a launch item is registered, the BackgroundTaskManagement subsystem logs the plist path and the target executable path to the unified log. Legitimate persistent software almost always runs an executable from a system or application directory. An executable staged in a temporary or world-writable directory (for example `/tmp`, `/private/tmp`, `/var/tmp`, `/Users/Shared`, or `/var/folders`) is a strong indicator of malicious persistence. This rule alerts on launch item registrations whose executable resides in such a location, and reports the plist path, item type, and executable.
 27
 28### Possible investigation steps
 29
 30- Review `Esql.executable` and `Esql.plist_path` in the alert to identify the staged program and its launch item.
 31- Retrieve and analyze the executable. Determine whether it is signed, what it does, and how it arrived on the host.
 32- Determine how and when the plist and executable were created, and by which process, using Elastic Defend telemetry if available.
 33- Review other alerts and activity for the host and associated user during the same period.
 34
 35### False positive analysis
 36
 37- Developer and build tooling occasionally runs helper executables from temporary or user directories. 
 38- Verify the executable and its origin; exclude known-good paths or signing identities if the behavior is expected.
 39
 40### Response and remediation
 41
 42- If the launch item is not legitimate, unload it with `launchctl bootout`, remove the plist, and remove or quarantine the executable.
 43- Investigate the host for the initial access vector and any activity performed by the program.
 44- Reset credentials for the affected user and review the host for additional compromise.
 45- Escalate to the security operations team if additional hosts show similar patterns.
 46"""
 47references = [
 48    "https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/",
 49    "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
 50]
 51risk_score = 47
 52rule_id = "0c5fb993-afea-4dcc-853d-1769f79d5d4d"
 53setup = """## Setup
 54
 55This rule requires data from the macOS Security Events integration.
 56Integration setup instructions: [macOS Security Events Integration for Elastic](https://www.elastic.co/docs/reference/integrations/macos)
 57"""
 58severity = "medium"
 59tags = [
 60    "OS: macOS",
 61    "Use Case: Threat Detection",
 62    "Tactic: Persistence",
 63    "Data Source: macOS Security Events",
 64    "Resources: Investigation Guide",
 65    "Rule Type: ESQL",
 66    "Platform: macOS",
 67    "Domain: Endpoint",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71query = '''
 72FROM logs-macos.process_execution_monitoring-* metadata _id, _version, _index
 73| WHERE data_stream.dataset == "macos.process_execution_monitoring" and
 74    macos.event.message.description LIKE "*effectiveItemDisposition*" and
 75    (macos.event.message.description LIKE "*url=file://*/Library/LaunchAgents/*" or
 76        macos.event.message.description LIKE "*url=file://*/Library/LaunchDaemons/*")
 77| GROK macos.event.message.description "url=file://%{DATA:Esql.plist_path}, config"
 78| GROK macos.event.message.description "type=%{DATA:Esql.item_type},"
 79| GROK macos.event.message.description "BTMConfigExecutablePath = \"%{DATA:Esql.executable}\""
 80| WHERE Esql.executable RLIKE "/(private/)?(tmp|var/tmp|var/folders)/.*|/Users/Shared/.*|/Users/[^/]+/(Downloads|Public|Library/Caches)/.*"
 81| KEEP _id, _version, _index, @timestamp, host.name, Esql.executable, Esql.plist_path, Esql.item_type, macos.event.message.description
 82'''
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86
 87[[rule.threat.technique]]
 88id = "T1543"
 89name = "Create or Modify System Process"
 90reference = "https://attack.mitre.org/techniques/T1543/"
 91
 92[[rule.threat.technique.subtechnique]]
 93id = "T1543.001"
 94name = "Launch Agent"
 95reference = "https://attack.mitre.org/techniques/T1543/001/"
 96
 97[[rule.threat.technique.subtechnique]]
 98id = "T1543.004"
 99name = "Launch Daemon"
100reference = "https://attack.mitre.org/techniques/T1543/004/"
101
102[rule.threat.tactic]
103id = "TA0003"
104name = "Persistence"
105reference = "https://attack.mitre.org/tactics/TA0003/"