Launch Agent

Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>$HOME/Library/LaunchAgents</code> ^{1 2 3}. These launch agents have property list files which point to the executables that will be launched ⁴. Adversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories ^{5 6}. The agent name may be disguised by using a name from a related operating system or benign software. Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in ^{7 8}. They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).

1. AppleDocs Launch Agent Daemons
2. OSX Keydnap malware
3. Antiquated Mac Malware
4. OSX.Dok Malware
5. Sofacy Komplex Trojan
6. Methods of Mac Malware Persistence
7. OSX Malware Detection
8. OceanLotus for OS X

使用该技术的组织

参考表中尚无组织使用记录。

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。