Persistence via Suspicious Launch Agent or Launch Daemon

  1[metadata]
  2creation_date = "2026/01/30"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the creation of a launch agent or daemon property list file containing abnormal or suspicious 
 11values. An adversary may establish persistence by installing a new launch agent or daemon which executes 
 12at login. This rule looks for plist files created in LaunchAgents/LaunchDaemons directories with paths 
 13commonly used by malware.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.file-*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "Persistence via Suspicious Launch Agent or Launch Daemon"
 20references = [
 21    "https://medium.com/red-teaming-with-a-blue-team-mentality/a-brief-look-at-macos-detections-and-post-infection-analysis-b0ede7ecfeb9",
 22    "https://objective-see.org/blog",
 23    "https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket"
 24]
 25risk_score = 73
 26rule_id = "62ba8542-1246-4647-9b84-98aa1bc0760a"
 27severity = "high"
 28tags = [
 29    "Domain: Endpoint",
 30    "OS: macOS",
 31    "Use Case: Threat Detection",
 32    "Tactic: Persistence",
 33    "Data Source: Elastic Defend",
 34    "Resources: Investigation Guide",
 35    "Noise: Medium",
 36    "Performance: Fast",
 37    "Rule Type: Event Correlation (EQL)",
 38    "Platform: macOS",
 39]
 40timestamp_override = "event.ingested"
 41type = "eql"
 42note = """## Triage and analysis
 43
 44> **Disclaimer**:
 45> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 46
 47### Investigating Persistence via Suspicious Launch Agent or Launch Daemon
 48
 49LaunchAgents and LaunchDaemons are the standard macOS mechanisms for starting programs automatically at user login or system boot. While essential for legitimate software, these persistence mechanisms are heavily abused by malware including RustBucket (DPRK), Shlayer, and CloudMensis. This detection rule identifies plist file creation in LaunchAgent/LaunchDaemon directories when performed by suspicious processes including scripts executing from temporary directories, unsigned binaries, or scripting interpreters like Python and osascript.
 50
 51### Possible investigation steps
 52
 53- Examine the file.path to identify the specific plist file created and its location (user vs system LaunchAgent/LaunchDaemon directory).
 54- Read the plist contents using plutil or defaults to identify the Program or ProgramArguments configured for execution.
 55- Analyze the process.executable to understand what created the plist file and assess whether execution from that location (temp directory, hidden folder) is suspicious.
 56- Check the process.name and process.code_signature fields to determine if the creating process was a scripting interpreter or unsigned binary.
 57- Locate the binary or script referenced in the plist and calculate its hash for threat intelligence lookups.
 58- Review the parent process chain to trace back to the initial execution vector that led to plist creation.
 59- Correlate with other file and process events to identify additional malware components that may have been deployed simultaneously.
 60
 61### False positive analysis
 62
 63- Legitimate software installers may create LaunchAgents/LaunchDaemons during setup, but typically from signed installer processes rather than scripts in temp directories.
 64- Development and testing environments may use scripting languages to create launch items. Verify with development teams if such activities are expected.
 65- Several legitimate signing IDs are already excluded including vim, JetBrains Toolbox, and Sublime Text.
 66- System utilities like cfprefsd may modify plist files during normal operations and are excluded.
 67- Enterprise deployment tools may use scripts to configure launch items. Document and exclude approved deployment processes.
 68
 69### Response and remediation
 70
 71- Immediately unload the suspicious LaunchAgent or LaunchDaemon using launchctl unload with the plist path.
 72- Remove the malicious plist file from the LaunchAgent or LaunchDaemon directory.
 73- Locate and remove the executable or script referenced in the plist's Program or ProgramArguments keys.
 74- Check for other persistence mechanisms that may have been deployed by the same threat actor.
 75- Review system logs for evidence of the persistence mechanism executing and what actions it performed.
 76- If the detection matches patterns of known malware families (RustBucket, Shlayer), perform comprehensive IOC searches and threat hunting.
 77- Reset any credentials that may have been accessed while the malicious process was running.
 78- Monitor for recreation of similar plist files to detect persistent access or ongoing compromise.
 79"""
 80query = '''
 81file where host.os.type == "macos" and event.type != "deletion" and 
 82  file.extension == "plist" and
 83  file.path like ("/Library/LaunchAgents/*", "/Library/LaunchDaemons/*", 
 84                  "/Users/*/Library/LaunchAgents/*", "/System/Library/LaunchAgents/*",
 85                  "/System/Library/LaunchDaemons/*") and
 86  (process.executable like ("/private/tmp/*", "/private/var/root/Library/*", "/var/tmp/*", 
 87                            "/tmp/*", "/var/folders/*", "/Users/Shared/*", "/var/root/*",
 88                            "/Library/WebServer/*", "/Library/Graphics/*", "/Library/Fonts/*") or
 89   process.name like~ ("python*", "osascript", "bash", "zsh", "sh", "curl", "nscurl", "wget", "java")) and
 90  not process.executable like ("/System/*", "/Library/PrivilegedHelperTools/*") and
 91  not (process.code_signature.signing_id in ("com.apple.vim", "com.apple.cat", "com.apple.cfprefsd",
 92                                            "com.jetbrains.toolbox", "com.apple.pico", "com.apple.shove",
 93                                            "com.sublimetext.4", "com.apple.ditto") and process.code_signature.trusted == true) and
 94  not (file.path like ("/Library/LaunchDaemons/com.jumpcloud.*",
 95                       "/Library/LaunchAgents/com.jumpcloud.*",
 96                       "/Library/LaunchDaemons/com.wazuh.*",
 97                       "/Library/LaunchDaemons/com.zscaler.service.plist") and
 98       process.executable == "/bin/bash")
 99'''
100
101[[rule.threat]]
102framework = "MITRE ATT&CK"
103
104  [rule.threat.tactic]
105  name = "Persistence"
106  id = "TA0003"
107  reference = "https://attack.mitre.org/tactics/TA0003/"
108
109  [[rule.threat.technique]]
110  name = "Boot or Logon Autostart Execution"
111  id = "T1547"
112  reference = "https://attack.mitre.org/techniques/T1547/"
113
114    [[rule.threat.technique.subtechnique]]
115    name = "Plist Modification"
116    id = "T1547.011"
117    reference = "https://attack.mitre.org/techniques/T1547/011/"
118
119  [[rule.threat.technique]]
120  name = "Create or Modify System Process"
121  id = "T1543"
122  reference = "https://attack.mitre.org/techniques/T1543/"
123
124    [[rule.threat.technique.subtechnique]]
125    name = "Launch Agent"
126    id = "T1543.001"
127    reference = "https://attack.mitre.org/techniques/T1543/001/"
128
129    [[rule.threat.technique.subtechnique]]
130    name = "Launch Daemon"
131    id = "T1543.004"
132    reference = "https://attack.mitre.org/techniques/T1543/004/"