Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> 1. These LaunchDaemons have property list files which point to the executables that will be launched 2. Adversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories 3. The daemon name may be disguised by using a name from a related operating system or benign software 4. Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root. The plist file permissions must be root:wheel, but the script or program that it points to has no such requirement. So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon’s executable and gain persistence or Privilege Escalation.
- AppleDocs Launch Agent Daemons
- Methods of Mac Malware Persistence
- OSX Malware Detection
- WireLurker
使用该技术的组织
参考表中尚无组织使用记录。
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核；置信度与有效期按引用读取。