huntrule

macOS: Unloading security agents via launchctl or disabling Gatekeeper

Detects macOS attempts to impair security by unloading known security agent plists via launchctl or disabling Gatekeeper with spctl.

FreeUnreviewedSigmamediumv1
title: "macOS: Unloading security agents via launchctl or disabling Gatekeeper"
id: 18eb0b8b-7453-4f4e-9a88-a8b0ae3141ff
status: test
description: This rule flags macOS process executions that attempt to disable security controls by unloading specified security-related services or by disabling Gatekeeper. Attackers may impair host defenses to enable persistence or subsequent malicious activity without interference. The detection relies on process creation telemetry for /bin/launchctl and /usr/sbin/spctl, matching command lines for service unload behavior and for known security plist identifiers or Gatekeeper disable actions.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: macos
detection:
  launchctl_unload:
    Image: /bin/launchctl
    CommandLine|contains: unload
  security_plists:
    CommandLine|contains:
      - com.objective-see.lulu.plist
      - com.objective-see.blockblock.plist
      - com.google.santad.plist
      - com.carbonblack.defense.daemon.plist
      - com.carbonblack.daemon.plist
      - at.obdev.littlesnitchd.plist
      - com.tenablesecurity.nessusagent.plist
      - com.opendns.osx.RoamingClientConfigUpdater.plist
      - com.crowdstrike.falcond.plist
      - com.crowdstrike.userdaemon.plist
      - osquery
      - filebeat
      - auditbeat
      - packetbeat
      - td-agent
  disable_gatekeeper:
    Image: /usr/sbin/spctl
    CommandLine|contains: disable
  condition: (launchctl_unload and security_plists) or disable_gatekeeper
falsepositives:
  - Legitimate activities
level: medium
license: DRL-1.1
related:
  - id: ff39f1a6-84ac-476f-a1af-37fcdf53d7c0
    type: derived

What it detects

This rule flags macOS process executions that attempt to disable security controls by unloading specified security-related services or by disabling Gatekeeper. Attackers may impair host defenses to enable persistence or subsequent malicious activity without interference. The detection relies on process creation telemetry for /bin/launchctl and /usr/sbin/spctl, matching command lines for service unload behavior and for known security plist identifiers or Gatekeeper disable actions.

Known false positives

  • Legitimate activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.