Launchd item registered
Inventory signal: a LaunchAgent/LaunchDaemon item was imported.
What it detects
Inventory signal: a LaunchAgent/LaunchDaemon item was imported. Informational — review alongside a known-good baseline; most launch items are legitimate software.
MITRE ATT&CK mapping
- T1543.004Create or Modify System Process: Launch Daemon· Persistence
False positives and triage
Fires on every imported launch item by design (inventory). Baseline known-good labels and focus on new or unusual entries; suppress this rule once baselined.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/macos/launchd_item_registered.yaml, licensed under the Apache License 2.0.
id: macos.persistence.launchd_item_registered
version: 1.0.0
status: experimental
severity: informational
confidence: 0.5
platforms: [macos]
mitre_techniques: [T1543.004]
description: |
Inventory signal: a LaunchAgent/LaunchDaemon item was imported. Informational —
review alongside a known-good baseline; most launch items are legitimate software.
match:
event_category: 'persistence'
event_action: 'launch_item_registered'
false_positive_guidance: |
Fires on every imported launch item by design (inventory). Baseline known-good
labels and focus on new or unusual entries; suppress this rule once baselined.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.