AN0736
Analytic 0736
macOS
Abuse of launchctl to execute or manage Launch Agents and Daemons. Defender perspective: correlation of suspicious plist file creation or modification in LaunchAgents/LaunchDaemons directories with subsequent execution of the launchctl command. Abnormal executable paths (e.g., /tmp, /Shared) or launchctl activity followed by network connections are highly suspicious.
macos:unifiedlog
execution of launchctl load/unload/start commands
macos:unifiedlog
write of plist files in /Library/LaunchAgents or /Library/LaunchDaemons
macos:unifiedlog
launchctl spawning new processes
macos:unifiedlog
creation or loading of new launchd services
[MonitoredPaths]
Paths to monitor for suspicious plist files, such as /Library/LaunchAgents, /Library/LaunchDaemons, ~/Library/LaunchAgents.
[SuspiciousExecPaths]
Uncommon executable paths (e.g., /tmp, /Shared) that should raise alerts when associated with launchctl services.
[TimeWindow]
Correlation window for detecting plist file creation and subsequent launchctl execution.