T1543.001No distinct observable

Launch Agent

Persistence · Privilege EscalationmacOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The single analytic AN1208 offers two Sigma logsources, {product: macos, service: unifiedlog} and {product: macos, service: osquery}, and neither has a field vocabulary to write against. Not in the brief, whose log source notes are prose — 'launchctl load or boot-time plist registration' and 'detection of new launch agents with suspicious paths or unsigned binaries' — with no field names anywhere. Not in lib/sigma, where scripts/mitre/logsource.mjs passes every macOS family straight through as {product: macos, service: } with the note 'macOS log', and translate.ts carries no macOS field map at all, so nothing downstream knows what a field on either source is called; across 303 published rules in this corpus, none uses product: macos. […]

Covered instead by T1543, T1543.004, T1059.002, T1548.004.

What the technique is

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents. Property list files use the Label, ProgramArguments, and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks. Launch Agents can also be executed using the Launchctl command. Adversaries may install a new Launch Agent that executes at login by placing a.plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true. The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.

Read it on attack.mitre.org

What MITRE says you would watch

AN1208
Detects creation or modification of user-level Launch Agents in monitored directories using.plist files with suspicious ProgramArguments or RunAtLoad keys. Correlates file write activity with execution of launchctl or unsigned binaries invoked at login.