macOS launchctl Execution of Launch Agent/Daemon
Flags launchctl usage on macOS to submit, load, or start Launch Agents/Daemons, a common persistence mechanism.
- Product
- macos
- Category
- process_creation
- Author
- Pratinav Chandra (SigmaHQ), DRL 1.1
- Published
- 2024-05-13
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies macOS process executions where launchctl is invoked with command-line arguments consistent with submitting, loading, or starting Launch Agents or Launch Daemons. Adversaries commonly use launchctl to establish persistence by scheduling services to run automatically. It relies on macOS process creation telemetry capturing the executed binary path and its command-line arguments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md
- sentinelone.comhttps://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
- welivesecurity.comhttps://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
- trendmicro.comhttps://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
- loobins.iohttps://www.loobins.io/binaries/launchctl/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_launchctl_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS launchctl Execution of Launch Agent/Daemon
id: e9e6e383-ffed-48a5-a2e9-e310ee42dfd6
status: test
description: This rule identifies macOS process executions where launchctl is invoked with command-line arguments consistent with submitting, loading, or starting Launch Agents or Launch Daemons. Adversaries commonly use launchctl to establish persistence by scheduling services to run automatically. It relies on macOS process creation telemetry capturing the executed binary path and its command-line arguments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md
- https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
- https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
- https://www.loobins.io/binaries/launchctl/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_launchctl_execution.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-13
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1569.001
- attack.t1543.001
- attack.t1543.004
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /launchctl
CommandLine|contains:
- submit
- load
- start
condition: selection
falsepositives:
- Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious.
level: medium
license: DRL-1.1
related:
- id: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
type: derived