Launchd malicious plist
Detects creation of a LaunchAgent/LaunchDaemon in a user- or admin-writable location, a common macOS persistence mechanism.
What it detects
Detects creation of a LaunchAgent/LaunchDaemon in a user- or admin-writable location, a common macOS persistence mechanism. SIP-protected /System/Library locations are excluded — only Apple can write there, and matching them floods analysts with known-good daemons.
MITRE ATT&CK mapping
False positives and triage
Many legitimate installers add LaunchAgents/Daemons. Baseline known-good labels per host and review new or unusual labels.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/macos/launchd_malicious_plist.yaml, licensed under the Apache License 2.0.
id: macos.persistence.launchd_malicious_plist
version: 1.0.1
status: experimental
severity: medium
confidence: 0.7
platforms: [macos]
mitre_techniques: [T1543.004, T1053]
description: |
Detects creation of a LaunchAgent/LaunchDaemon in a user- or admin-writable location, a
common macOS persistence mechanism. SIP-protected /System/Library locations are excluded —
only Apple can write there, and matching them floods analysts with known-good daemons.
match:
event_category: persistence
event_action: task_created
provider: launchd
file_path_regex: "^(/Users/[^/]+)?/Library/Launch(Agents|Daemons)/[^/]+\\.plist$"
false_positive_guidance: |
Many legitimate installers add LaunchAgents/Daemons. Baseline known-good labels per host
and review new or unusual labels.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.