Detection rules › Sigma
macOS LaunchAgent/LaunchDaemon Persistence
Detects creation or modification of LaunchAgent or LaunchDaemon plist files, which are commonly used for persistence on macOS. Attackers may create or modify these to execute malicious code at login or system startup.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1543.001 Create or Modify System Process: Launch Agent |
Rule body yaml
title: macOS LaunchAgent/LaunchDaemon Persistence
id: b2c3d4e5-f6a7-4890-bcde-f01234567890
status: experimental
description: |
Detects creation or modification of LaunchAgent or LaunchDaemon plist files,
which are commonly used for persistence on macOS. Attackers may create or modify
these to execute malicious code at login or system startup.
references:
- https://attack.mitre.org/techniques/T1543/001/
- https://www.sentinelone.com/blog/how-malware-persists-on-macos/
author: Eric Brown - Nebulock, Inc.
date: 2025/01/22
modified: 2025/01/22
logsource:
product: macos
service: unifiedlog
detection:
selection_subsystem:
subsystem: com.apple.launchd
selection_persistence:
message|contains:
- 'LaunchAgent'
- 'LaunchDaemon'
- 'loaded'
- 'submitted'
- 'bootstrap'
selection_paths:
message|contains:
- '/Library/LaunchAgents'
- '/Library/LaunchDaemons'
- '~/Library/LaunchAgents'
- '/System/Library/LaunchAgents'
- '/System/Library/LaunchDaemons'
filter_system:
message|contains:
- 'com.apple.'
condition: selection_subsystem and (selection_persistence or selection_paths) and not filter_system
falsepositives:
- Legitimate software installation
- System updates
- Enterprise management tools
level: medium
tags:
- attack.persistence
- attack.t1543.001
Stages and Predicates
Stage 0: condition
selection_subsystem and (selection_persistence or selection_paths) and not filter_systemStage 1: selection_subsystem
selection_subsystem:
subsystem: com.apple.launchd
Stage 2: selection_persistence
selection_persistence:
message|contains:
- 'LaunchAgent'
- 'LaunchDaemon'
- 'loaded'
- 'submitted'
- 'bootstrap'
Stage 3: selection_paths
selection_paths:
message|contains:
- '/Library/LaunchAgents'
- '/Library/LaunchDaemons'
- '~/Library/LaunchAgents'
- '/System/Library/LaunchAgents'
- '/System/Library/LaunchDaemons'
Stage 4: not filter_system
filter_system:
message|contains:
- 'com.apple.'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
message | match | com.apple. |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.