Launchctl
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The brief holds one analytic, AN0736, and all four of its log sources resolve to the same Sigma logsource — {product: macos, service: unifiedlog} — for which no field vocabulary exists anywhere in this pipeline. Not in the brief: the four entries give prose notes only ('execution of launchctl load/unload/start commands', 'write of plist files in /Library/LaunchAgents or /Library/LaunchDaemons', 'launchctl spawning new processes', 'creation or loading of new launchd services') and name no fields. Not in lib/sigma, which has no macOS field mapping at all — scripts/mitre/logsource.mjs (the family === "macos" || family === "openbsm" branch) passes every macOS channel straight through as {product: macos, service: } with the note 'macOS log', so nothing downstream knows what a field on that source is called; no rule in this corpus uses that logsource. […]
What the technique is
Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0736
Abuse of launchctl to execute or manage Launch Agents and Daemons. Defender perspective: correlation of suspicious plist file creation or modification in LaunchAgents/LaunchDaemons directories with subsequent execution of the launchctl command. Abnormal executable paths (e.g., /tmp, /Shared) or launchctl activity followed by network connections are highly suspicious.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.