{"id":"ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e","title":"Launch Agent/Daemon Execution Via Launchctl","description":"Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.","author":"Pratinav Chandra","status":"test","level":"medium","date":"2024-05-13","modified":"","tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1569.001","attack.t1543.001","attack.t1543.004"],"technique_ids":["T1543.001","T1543.004","T1569.001"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious."],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md","https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/","https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/","https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html","https://www.loobins.io/binaries/launchctl/"],"source_path":"rules/macos/process_creation/proc_creation_macos_launchctl_execution.yml","source_sha256":"335a4a0f8b2dd50193c6c7c96e3c75e13fcc74b40c6a0c6377653619fe9587dc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_launchctl_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Launch Agent/Daemon Execution Via Launchctl\nid: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e\nstatus: test\ndescription: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md\n    - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/\n    - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/\n    - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html\n    - https://www.loobins.io/binaries/launchctl/\nauthor: Pratinav Chandra\ndate: 2024-05-13\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.persistence\n    - attack.t1569.001\n    - attack.t1543.001\n    - attack.t1543.004\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/launchctl'\n        CommandLine|contains:\n            - 'submit'\n            - 'load'\n            - 'start'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1543.001","id":"T1543.001","name":"Launch Agent","page":"techniques/enterprise/T1543.001/"},{"key":"enterprise/T1543.004","id":"T1543.004","name":"Launch Daemon","page":"techniques/enterprise/T1543.004/"},{"key":"enterprise/T1569.001","id":"T1569.001","name":"Launchctl","page":"techniques/enterprise/T1569.001/"}],"data_path":"data/detection-rules/ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e.json","kind":"sigma"}