huntrule

macOS Persistence Attempt Using PlistBuddy to Modify LaunchAgents/LaunchDaemons

Identifies PlistBuddy commands that enable RunAtLoad for LaunchAgents or LaunchDaemons persistence on macOS.

FreeReviewedSigma · High · v2
Product
macos
Category
process_creation
Author
Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
Published
2023-02-18
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags macOS process executions of PlistBuddy where the command line includes RunAtLoad=true and references either LaunchAgents or LaunchDaemons. This behavior is commonly associated with creating or updating launch configuration that can cause code to run automatically at load time. It relies on macOS process creation telemetry, specifically the executable path ending in /PlistBuddy and the presence of the relevant command-line arguments.

Reporting behind it

Related detections9 linkedT1543.001 — drag to rearrange
LaunchAgent or LaunchDaemon Persistence File Creation on macOS (via file_event)
Malicious Mini Shai-Hulud gh-token-monitor Persistence Service (via file_event)
Suspicious macOS LaunchAgent or LaunchDaemon Plist Creation
macOS launchctl Execution of Launch Agent/Daemon
Suspicious COOKIE SPIDER LaunchDaemon Persistence via com.finder.helper Property List (via file_event)
Suspicious Persistence Load via Launchctl (via process_creation)
Masquerading Cuckoo Stealer LaunchAgent Masquerading as Homebrew Updater (via file_event)
Suspicious LaunchAgent Masquerading as coreaudiod (via file_event)
Suspicious LaunchAgent or LaunchDaemon Load via launchctl
macOS Persistence Attempt Using PlistBuddy to Modify LaunchAgents/LaunchDaemons
Pivot detection · T1543.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.