Skip to content
Every technique
T1569.001No distinct observable

Launchctl

ExecutionmacOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The brief holds one analytic, AN0736, and all four of its log sources resolve to the same Sigma logsource — {product: macos, service: unifiedlog} — for which no field vocabulary exists anywhere in this pipeline. Not in the brief: the four entries give prose notes only ('execution of launchctl load/unload/start commands', 'write of plist files in /Library/LaunchAgents or /Library/LaunchDaemons', 'launchctl spawning new processes', 'creation or loading of new launchd services') and name no fields. Not in lib/sigma, which has no macOS field mapping at all — scripts/mitre/logsource.mjs (the family === "macos" || family === "openbsm" branch) passes every macOS channel straight through as {product: macos, service: } with the note 'macOS log', so nothing downstream knows what a field on that source is called; no rule in this corpus uses that logsource. […]

Covered instead by T1569, T1543.001, T1543.004, T1059.002.

What the technique is

Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.

Read it on attack.mitre.org

What MITRE says you would watch

  • AN0736

    Abuse of launchctl to execute or manage Launch Agents and Daemons. Defender perspective: correlation of suspicious plist file creation or modification in LaunchAgents/LaunchDaemons directories with subsequent execution of the launchctl command. Abnormal executable paths (e.g., /tmp, /Shared) or launchctl activity followed by network connections are highly suspicious.

Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.