Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>$HOME/Library/LaunchAgents</code> 1 2 3. These launch agents have property list files which point to the executables that will be launched 4. Adversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories 5 6. The agent name may be disguised by using a name from a related operating system or benign software. Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in 7 8. They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).
- AppleDocs Launch Agent Daemons
- OSX Keydnap malware
- Antiquated Mac Malware
- OSX.Dok Malware
- Sofacy Komplex Trojan
- Methods of Mac Malware Persistence
- OSX Malware Detection
- OceanLotus for OS X
Groups using this technique
No group use in the reference set yet.
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.