attack.t1543.004

Atomic MacOS Stealer - Persistence Indicators

Nov 24, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1564.001 attack.t1543.004 detection.emerging-threats ·

Share on:

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

Launch Agent/Daemon Execution Via Launchctl

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004 ·

Share on:

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Potential Persistence Via PlistBuddy

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.001 attack.t1543.004 ·

Share on:

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility