Techniques › T1543 › T1543.001
T1543.001 Launch Agent
persistence · privilege escalation — macOS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
2
Sigma rules tagged attack.t1543.001
0
KEV CVEs mapped here
<p>Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.</p><p>Launch Agents can also be executed using the Launchctl command.</p><p>Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the <code>RunAtLoad</code> or <code>KeepAlive</code> keys set to <code>true</code>. The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0434 Detection of Launch Agent Creation or Modification on macOS v1.0
AN1208 macOSDetects creation or modification of user-level Launch Agents in monitored directories using
.plistfiles with suspiciousProgramArgumentsorRunAtLoadkeys. Correlates file write activity with execution oflaunchctlor unsigned binaries invoked at login.macos:osquerydetection of new launch agents with suspicious paths or unsigned binaries→ DC0060 Service CreationTunable:PlistDirectoryListPlistKeyMonitorExecutablePathPatternUnsignedBinaryAlertUserContextScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1543.001
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · 65d506d3-fcfe-4071-b4b2-bcefe721bbbb
Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
Author: Pratinav Chandra
· 2024-05-13 · logsource: product=macos category=process_creation · ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
Rules tagged at the parent level (attack.t1543) 9
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=driver_load · 10cb6535-b31d-4512-9962-513dcbc42cc1
Detects driver load of the System Informer tool
Author: Florian Roth (Nextron Systems)
· 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Author: Florian Roth (Nextron Systems)
· 2022-11-16 (modified 2024-11-23) · logsource: product=windows category=driver_load · 67add051-9ee7-4ad3-93ba-42935615ae8d
Detects driver load of the Process Hacker tool
Author: Tim Rauch (Nextron Systems), Elastic (idea)
· 2022-09-15 (modified 2023-01-04) · logsource: product=windows service=system · 71c276aa-49cd-43d2-b920-2dcd3e6962d5
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Author: Florian Roth (Nextron Systems)
· 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · 811e0002-b13b-4a15-9d00-a613fce66e42
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-06 · logsource: product=windows service=codeintegrity-operational · 9b72b82d-f1c5-4632-b589-187159bc6ec1
Detects blocked load attempts of revoked drivers
Author: Tim Rauch (Nextron Systems), Elastic (idea)
· 2022-09-15 (modified 2023-01-04) · logsource: product=windows service=security · c4e92a97-a9ff-4392-9d2d-7a4c642768ca
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-11-10 (modified 2023-06-07) · logsource: product=windows service=codeintegrity-operational · e4be5675-4a53-426a-8c81-a8bb2387e947
Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.
Author: Sittikorn S, Tim Shelton
· 2022-05-11 (modified 2022-10-05) · logsource: product=windows service=system · e97d9903-53b2-41fc-8cb9-889ed4093e80
Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)