Launch Agent/Daemon Execution Via Launchctl

calendar Aug 12, 2024 · attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004  ·
Share on: linkedin copy

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Sigma rule (View on GitHub)

 1title: Launch Agent/Daemon Execution Via Launchctl
 2id: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
 3status: experimental
 4description: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md
 7    - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
 8    - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
 9    - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
10    - https://www.loobins.io/binaries/launchctl/
11author: Pratinav Chandra
12date: 2024-05-13
13tags:
14    - attack.execution
15    - attack.persistence
16    - attack.t1569.001
17    - attack.t1543.001
18    - attack.t1543.004
19logsource:
20    category: process_creation
21    product: macos
22detection:
23    selection:
24        Image|endswith: '/launchctl'
25        CommandLine|contains:
26            - 'submit'
27            - 'load'
28            - 'start'
29    condition: selection
30falsepositives:
31    - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious.
32level: medium

References

Related rules

to-top