Techniques › T1543.001 › AN1208
AN1208 Analytic 1208
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects creation or modification of user-level Launch Agents in monitored directories using
.plist files with suspicious ProgramArguments or RunAtLoad keys. Correlates file write activity with execution of launchctl or unsigned binaries invoked at login.</p>- Detects
- T1543.001 Launch Agent
- Part of
- DET0434 Detection of Launch Agent Creation or Modification on macOS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | launchctl load or boot-time plist registration | DC0064 Command Execution |
| fs:fsusage | write or chmod to ~/Library/LaunchAgents/*.plist | DC0039 File Creation |
| fs:fsusage | modification of existing LaunchAgents plist | DC0061 File Modification |
| macos:osquery | detection of new launch agents with suspicious paths or unsigned binaries | DC0060 Service Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PlistDirectoryList | Monitored directories (e.g., `/Library/LaunchAgents`, `~/Library/LaunchAgents`) for plist drops |
PlistKeyMonitor | Monitored keys such as `RunAtLoad`, `KeepAlive`, or `ProgramArguments` for policy alignment |
ExecutablePathPattern | Patterns used to detect execution from non-standard or suspicious locations like `/tmp`, `/var`, or `/Users/Shared` |
UnsignedBinaryAlert | Raise alerts if the binary referenced in the Launch Agent is unsigned or unverified |
UserContextScope | List of users whose LaunchAgents are considered high-sensitivity (e.g., admins) |