Detection rules › Sigma
macOS ESF Launch Persistence Creation
Detect creation of launchd persistence files in LaunchAgents/LaunchDaemons.
Known false positives
- legitimate software installations
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Rule body
title: macOS ESF Launch Persistence Creation
id: a2f1e7f3-2a5b-4d17-8a9f-60a6b7b0a09f
status: experimental
description: Detect creation of launchd persistence files in LaunchAgents/LaunchDaemons.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
product: macos
service: endpointsecurity
level: high
detection:
selection_evt:
esf.event_type: 13
event.action: create
selection_path:
TargetFilename|startswith:
- /Library/LaunchDaemons/
- /Library/LaunchAgents/
- /System/Library/LaunchDaemons/
selection_ext:
TargetFilename|endswith: .plist
condition: selection_evt and selection_path and selection_ext
falsepositives:
- legitimate software installations
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selection_evt and selection_path and selection_extStage 1: selection_evt
selection_evt:
esf.event_type: 13
event.action: create
Stage 2: selection_path
selection_path:
TargetFilename|startswith:
- /Library/LaunchDaemons/
- /Library/LaunchAgents/
- /System/Library/LaunchDaemons/
Stage 3: selection_ext
selection_ext:
TargetFilename|endswith: .plist
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with value:".plist" |
TargetFilename | starts_with |
| field:"TargetFilename" kind:starts_with |
esf.event_type | eq |
| field:"esf.event_type" kind:eq value:"13" |
event.action | eq |
| field:"EventType" kind:eq value:"create" |