macOS Emond Launch Daemon Rule Install Monitoring via plist and emondClients Paths
Alerts on macOS Emond rule plist or emond client database changes that may indicate persistence setup.
- Product
- macos
- Category
- file_event
- Author
- Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-23
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation or modification events involving macOS Emond configuration files placed under /etc/emond.d/rules/ with .plist extensions, as well as changes to /private/var/db/emondClients/. Adversaries can use Emond launch daemon rules to establish persistence and potentially trigger actions that lead to elevated privileges. The detection relies on file event telemetry capturing TargetFilename values for these specific directories and filename patterns.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md
- posts.specterops.iohttps://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/file_event/file_event_macos_emond_launch_daemon.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Emond Launch Daemon Rule Install Monitoring via plist and emondClients Paths
id: 118e64fc-c78b-4a86-939c-78dc33e82807
status: test
description: This rule flags file creation or modification events involving macOS Emond configuration files placed under /etc/emond.d/rules/ with .plist extensions, as well as changes to /private/var/db/emondClients/. Adversaries can use Emond launch daemon rules to establish persistence and potentially trigger actions that lead to elevated privileges. The detection relies on file event telemetry capturing TargetFilename values for these specific directories and filename patterns.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md
- https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/file_event/file_event_macos_emond_launch_daemon.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-23
modified: 2021-11-27
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1546.014
logsource:
category: file_event
product: macos
detection:
selection_1:
TargetFilename|contains: /etc/emond.d/rules/
TargetFilename|endswith: .plist
selection_2:
TargetFilename|contains: /private/var/db/emondClients/
condition: 1 of selection_*
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: 23c43900-e732-45a4-8354-63e4a6c187ce
type: derived