Techniques › T1668 › AN0047
AN0047 Analytic 0047
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects unauthorized termination of system daemons or commands issued through launchctl or kill to stop competing services or malware processes. Defenders should monitor unified logs and EDR telemetry for unusual service modifications or terminations.</p>
- Detects
- T1668 Exclusive Control
- Part of
- DET0015 Detection Strategy for Exclusive Control
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | launchctl unload, kill, or pkill commands affecting daemons or background services | DC0064 Command Execution |
| macos:osquery | process_termination: Unexpected termination of processes tied to vulnerable or high-value services | DC0033 Process Termination |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ProtectedServiceList | Defines macOS services (e.g., securityd, keychain-related daemons) that should never be disabled. |