Techniques › T1569 › T1569.001
T1569.001 Launchctl
execution — macOS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1569.001
0
KEV CVEs mapped here
<p>Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.</p><p>Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute Launch Agents or Launch Daemons.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0265 Detection Strategy for System Services: Launchctl v1.0
AN0736 macOSAbuse of launchctl to execute or manage Launch Agents and Daemons. Defender perspective: correlation of suspicious plist file creation or modification in LaunchAgents/LaunchDaemons directories with subsequent execution of the launchctl command. Abnormal executable paths (e.g., /tmp, /Shared) or launchctl activity followed by network connections are highly suspicious.macos:unifiedlog
write of plist files in /Library/LaunchAgents or /Library/LaunchDaemons→ DC0061 File ModificationTunable:MonitoredPathsSuspiciousExecPathsTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1569.001
Author: Pratinav Chandra
· 2024-05-13 · logsource: product=macos category=process_creation · ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
Rules tagged at the parent level (attack.t1569) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Tim Shelton
· 2021-06-30 (modified 2022-11-15) · logsource: product=windows service=printservice-admin · 4e64668a-4da1-49f5-a8df-9e2d5b866718
Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675
Author: omkar72
· 2020-10-30 (modified 2023-02-28) · logsource: product=windows category=process_creation · 730fc21b-eaff-474b-ad23-90fd265d4988
Detects user accept agreement execution in psexec commandline
Author: INIT_6
· 2021-07-02 (modified 2022-10-05) · logsource: product=windows service=security · 8fe1c584-ee61-444b-be21-e9054b229694
Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527
Author: Florian Roth (Nextron Systems)
· 2021-07-01 (modified 2022-10-09) · logsource: product=windows service=printservice-operational · f34d942d-c8c4-4f1f-b196-22471aecf10a
Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675