macOS Persistence Attempts Using PlistBuddy to Configure LaunchAgents/LaunchDaemons

title: macOS Persistence Attempts Using PlistBuddy to Configure LaunchAgents/LaunchDaemons
id: 12dd3ef7-7b8b-4dad-8247-879257c79fa2
status: test
description: This rule flags process executions of PlistBuddy where the command line indicates enabling RunAtLoad and references LaunchAgents or LaunchDaemons. Attackers can use these components to establish persistence that starts automatically via macOS launch configurations. The detection relies on macOS process creation telemetry, specifically the executable path ending in /PlistBuddy and required command-line content.
references:
  - https://redcanary.com/blog/clipping-silver-sparrows-wings/
  - https://www.manpagez.com/man/8/PlistBuddy/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-02-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1543.001
  - attack.t1543.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /PlistBuddy
    CommandLine|contains|all:
      - RunAtLoad
      - "true"
    CommandLine|contains:
      - LaunchAgents
      - LaunchDaemons
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb
    type: derived