Detects creation or modification of user-level Launch Agents in monitored directories using `.plist` files with suspicious `ProgramArguments` or `RunAtLoad` keys. Correlates file write activity with execution of `launchctl` or unsigned binaries invoked at login.
macos:unifiedlog
launchctl load or boot-time plist registration
fs:fsusage
write or chmod to ~/Library/LaunchAgents/*.plist
fs:fsusage
modification of existing LaunchAgents plist
macos:osquery
detection of new launch agents with suspicious paths or unsigned binaries
[PlistDirectoryList]
Monitored directories (e.g., `/Library/LaunchAgents`, `~/Library/LaunchAgents`) for plist drops
[PlistKeyMonitor]
Monitored keys such as `RunAtLoad`, `KeepAlive`, or `ProgramArguments` for policy alignment
[ExecutablePathPattern]
Patterns used to detect execution from non-standard or suspicious locations like `/tmp`, `/var`, or `/Users/Shared`
[UnsignedBinaryAlert]
Raise alerts if the binary referenced in the Launch Agent is unsigned or unverified
[UserContextScope]
List of users whose LaunchAgents are considered high-sensitivity (e.g., admins)