Detection of Unauthorized macOS Launch Service Persistence

Adversaries targeting macOS systems often seek to establish persistence to ensure their malicious payloads survive system reboots or user logouts. A primary method for achieving this is through the abuse of macOS launch services, specifically by creating or modifying property list (plist) files within designated LaunchAgent or LaunchDaemon directories. By placing a configuration file in these locations, an attacker defines a service that the operating system's launchd subsystem will execute automatically. To finalize this process, attackers typically use the launchctl utility to manually load or bootstrap the newly created service into the system configuration. This sequence of file creation followed by immediate service activation is a strong indicator of persistence establishment and should be closely monitored by security teams to detect unauthorized background execution.

Attack Chain

1. Attacker gains initial access or code execution on the macOS endpoint.
2. Attacker prepares a malicious payload (script or binary) to be executed.
3. Attacker creates or modifies a plist configuration file defining the service.
4. Attacker writes the plist file to a persistence directory (e.g., /Library/LaunchAgents/).
5. Attacker executes launchctl with the load or bootstrap argument.
6. The launchd process processes the request and registers the new service.
7. The malicious service is now configured to run automatically upon system start or login.
8. Final objective: persistence for recurring malicious activity or exfiltration.

Impact

Successful exploitation allows attackers to maintain long-term, stealthy control over the compromised macOS host. This permits continuous exfiltration of data, recurring monitoring of user activity, or periodic command-and-control communication, significantly increasing the difficulty of incident remediation and eradication.

Recommendation

Prioritize the identification of unauthorized modifications to launch service directories and the subsequent invocation of launchctl.

• Deploy the Sigma rule provided below to identify sequences of plist creation followed by launchctl service loading.
• Review all current LaunchAgent and LaunchDaemon plists in /System/Library/, /Library/, and /Users/*/Library/ for suspicious executables.
• Establish a baseline of legitimate software that requires launch service persistence to reduce false positives during incident response.