macOS Persistence Attempt Using PlistBuddy to Modify LaunchAgents/LaunchDaemons
Identifies PlistBuddy commands that enable RunAtLoad for LaunchAgents or LaunchDaemons persistence on macOS.
- Product
- macos
- Category
- process_creation
- Author
- Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
- Published
- 2023-02-18
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags macOS process executions of PlistBuddy where the command line includes RunAtLoad=true and references either LaunchAgents or LaunchDaemons. This behavior is commonly associated with creating or updating launch configuration that can cause code to run automatically at load time. It relies on macOS process creation telemetry, specifically the executable path ending in /PlistBuddy and the presence of the relevant command-line arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Persistence Attempt Using PlistBuddy to Modify LaunchAgents/LaunchDaemons
id: 12dd3ef7-7b8b-4dad-8247-879257c79fa2
status: test
description: This rule flags macOS process executions of PlistBuddy where the command line includes RunAtLoad=true and references either LaunchAgents or LaunchDaemons. This behavior is commonly associated with creating or updating launch configuration that can cause code to run automatically at load time. It relies on macOS process creation telemetry, specifically the executable path ending in /PlistBuddy and the presence of the relevant command-line arguments.
references:
- https://redcanary.com/blog/clipping-silver-sparrows-wings/
- https://www.manpagez.com/man/8/PlistBuddy/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-02-18
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1543.001
- attack.t1543.004
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /PlistBuddy
CommandLine|contains|all:
- RunAtLoad
- "true"
CommandLine|contains:
- LaunchAgents
- LaunchDaemons
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb
type: derived