Detection rules › Sigma

macOS LaunchAgent/LaunchDaemon Persistence

Status
experimental
Severity
medium
Log source
product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects creation or modification of LaunchAgent or LaunchDaemon plist files, which are commonly used for persistence on macOS. Attackers may create or modify these to execute malicious code at login or system startup.

MITRE ATT&CK coverage

Rule body yaml

title: macOS LaunchAgent/LaunchDaemon Persistence
id: b2c3d4e5-f6a7-4890-bcde-f01234567890
status: experimental
description: |
  Detects creation or modification of LaunchAgent or LaunchDaemon plist files,
  which are commonly used for persistence on macOS. Attackers may create or modify
  these to execute malicious code at login or system startup.
references:
  - https://attack.mitre.org/techniques/T1543/001/
  - https://www.sentinelone.com/blog/how-malware-persists-on-macos/
author: Eric Brown - Nebulock, Inc.
date: 2025/01/22
modified: 2025/01/22
logsource:
  product: macos
  service: unifiedlog
detection:
  selection_subsystem:
    subsystem: com.apple.launchd
  selection_persistence:
    message|contains:
      - 'LaunchAgent'
      - 'LaunchDaemon'
      - 'loaded'
      - 'submitted'
      - 'bootstrap'
  selection_paths:
    message|contains:
      - '/Library/LaunchAgents'
      - '/Library/LaunchDaemons'
      - '~/Library/LaunchAgents'
      - '/System/Library/LaunchAgents'
      - '/System/Library/LaunchDaemons'
  filter_system:
    message|contains:
      - 'com.apple.'
  condition: selection_subsystem and (selection_persistence or selection_paths) and not filter_system
falsepositives:
  - Legitimate software installation
  - System updates
  - Enterprise management tools
level: medium
tags:
  - attack.persistence
  - attack.t1543.001

Stages and Predicates

Stage 0: condition

selection_subsystem and (selection_persistence or selection_paths) and not filter_system

Stage 1: selection_subsystem

selection_subsystem:
  subsystem: com.apple.launchd

Stage 2: selection_persistence

selection_persistence:
  message|contains:
    - 'LaunchAgent'
    - 'LaunchDaemon'
    - 'loaded'
    - 'submitted'
    - 'bootstrap'

Stage 3: selection_paths

selection_paths:
  message|contains:
    - '/Library/LaunchAgents'
    - '/Library/LaunchDaemons'
    - '~/Library/LaunchAgents'
    - '/System/Library/LaunchAgents'
    - '/System/Library/LaunchDaemons'

Stage 4: not filter_system

filter_system:
  message|contains:
    - 'com.apple.'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
messagematchcom.apple.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
messagematch
  • /Library/LaunchAgents
  • /Library/LaunchDaemons
  • /System/Library/LaunchAgents
  • /System/Library/LaunchDaemons
  • LaunchAgent
  • LaunchDaemon
  • bootstrap
  • loaded
  • submitted
  • ~/Library/LaunchAgents
subsystemeq
  • com.apple.launchd