The sub-techniques beta is now live! Read the release blog post for more info.

Plist Modification

Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as /Library/Preferences (which execute with elevated privileges) and ~/Library/Preferences (which execute with a user's privileges). Adversaries can modify these plist files to point to their own code, can use them to execute their code in the context of another user, bypass whitelisting procedures, or even use them as a persistence mechanism. [1]

ID: T1150
Tactic: Defense Evasion, Persistence, Privilege Escalation
Platform: macOS
Permissions Required: User, Administrator
Data Sources: File monitoring, Process monitoring, Process command-line parameters
Defense Bypassed: Application whitelisting, Process whitelisting, Whitelisting by file name or path
Version: 1.0
Created: 14 December 2017
Last Modified: 25 June 2019


Mitigation Description
Restrict File and Directory Permissions

Prevent plist files from being modified by users by making them read-only.


File system monitoring can determine if plist files are being modified. Users should not have permission to modify these in most cases. Some software tools like "Knock Knock" can detect persistence mechanisms and point to the specific files that are being referenced. This can be helpful to see what is actually being executed.

Monitor process execution for abnormal process execution resulting from modified plist files. Monitor utilities used to modify plist files or that take a plist file as an argument, which may indicate suspicious activity.