Attack Chain

1. The attacker gains initial access to the macOS system through methods such as exploiting vulnerabilities, social engineering, or phishing.
2. The attacker achieves code execution within a Python process. This can occur via a malicious script, a compromised Python package, or by exploiting deserialization vulnerabilities like pickle.load or torch.load.
3. The malicious Python script crafts a LaunchAgent or LaunchDaemon plist file. This plist file contains configuration details about the program to be executed, including its path, arguments, and execution triggers.
4. The Python process writes the crafted plist file to either the /Library/LaunchAgents/ (for user-level persistence) or /Library/LaunchDaemons/ (for system-level persistence) directory.
5. The LaunchAgent or LaunchDaemon is automatically loaded by launchd at login or boot, according to the configuration specified in the plist file.
6. The program specified in the plist file is executed, giving the attacker persistent access to the compromised system.
7. The attacker can then use this persistent access to perform various malicious activities, such as data exfiltration, lateral movement, or deploying additional malware.

Impact

A successful attack can lead to persistent compromise of macOS systems. Attackers can maintain unauthorized access, execute arbitrary code, steal sensitive data, or use the compromised system as a foothold for further attacks within the network. The impact can range from individual user data theft to widespread organizational breaches, depending on the attacker’s objectives and the system’s role within the network.

Recommendation

• Deploy the Sigma rule “Detect Python Launch Agent/Daemon Creation” to your SIEM to identify when a Python process creates a LaunchAgent or LaunchDaemon plist file.
• Enable Elastic Defend endpoint logging to capture event.action:"launch_daemon" events, which are necessary for the Sigma rule to function correctly.
• Prioritize investigation of alerts generated by the Sigma rule, focusing on understanding the program arguments, run-at-load configuration, and keep-alive settings within the created plist file.
• Implement strict dependency management and vulnerability scanning for Python environments to prevent the use of compromised packages.
• Monitor for processes loading model files (torch.load, pickle.load) and investigate any suspicious activity to prevent exploitation of deserialization vulnerabilities.