Launch Agent/Daemon Execution Via Launchctl

 1title: Launch Agent/Daemon Execution Via Launchctl
 2id: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
 3status: experimental
 4description: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md
 7    - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
 8    - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
 9    - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
10    - https://www.loobins.io/binaries/launchctl/
11author: Pratinav Chandra
12date: 2024/05/13
13tags:
14    - attack.execution
15    - attack.persistence
16    - attack.t1569.001
17    - attack.t1543.001
18    - attack.t1543.004
19logsource:
20    category: process_creation
21    product: macos
22detection:
23    selection:
24        Image|endswith: '/launchctl'
25        CommandLine|contains:
26            - 'submit'
27            - 'load'
28            - 'start'
29    condition: selection
30falsepositives:
31    - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious.
32level: medium

References

• atomic-red-team/atomics/T1569.001/T1569.001.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

• 20 Common Tools & Techniques Used by macOS Threat Actors & Malware - SentinelLabs

  

  Threat hunting on macOS? These are the tools malware most often leverages, with ITW examples, MITRE behavioral indicators and links to further research.

  
  Read More

• Mac cryptocurrency trading application rebranded, bundled with malware

  

  ESET researchers uncover websites distributing malicious cryptocurrency trading applications for Mac, with the malware used to steal information such as browser cookies, cryptocurrency wallets and screen captures.

  
  Read More

• New MacOS Backdoor Linked to OceanLotus Found

  

  We identified a MacOS backdoor that we believe is the latest version of a threat used by OceanLotus, a group responsible for launching targeted attacks against human rights organizations, media organizations, research institutes, and more.

  
  Read More

• launchctl

  

  Interact with LaunchAgents and LaunchDaemons.

  
  Read More

Related rules

• Potential Persistence Via PlistBuddy
• Suspicious Scheduled Task Creation Involving Temp Folder
• Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
• Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
• UNC4841 - Barracuda ESG Exploitation Indicators