Create or Modify System Process: Launch Agent

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.[1][2] [3] Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.[4] Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Launch Agents can also be executed using the Launchctl command.

Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.[5][6] The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.[7][8]

ID: T1543.001
Sub-technique of:  T1543
Platforms: macOS
Permissions Required: Administrator, User
Version: 1.2
Created: 17 January 2020
Last Modified: 15 October 2021

Procedure Examples

ID Name Description
S0482 Bundlore

Bundlore can persist via a LaunchAgent.[9]

S0274 Calisto

Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.[10]

S0369 CoinTicker

CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.[11]

S0492 CookieMiner

CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.[12]

S0235 CrossRAT

CrossRAT creates a Launch Agent on macOS.[13]

S0497 Dacls

Dacls can establish persistence via a LaunchAgent.[14][15]

S0281 Dok

Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format com.random.name.plist.[16][17]

S0277 FruitFly

FruitFly persists via a Launch Agent.[16]

S0276 Keydnap

Keydnap uses a Launch Agent to persist.[18]

S0162 Komplex

The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.[5]

S0282 MacSpy

MacSpy persists via a Launch Agent.[16]

S0198 NETWIRE

NETWIRE can use launch agents for persistence.[19]

S0352 OSX_OCEANLOTUS.D

OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.[20][21]

S0279 Proton

Proton persists via Launch Agent.[16]

S0595 ThiefQuest

ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.[22]

Mitigations

ID Mitigation Description
M1018 User Account Management

Restrict user's abilities to create Launch Agents with group policy.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Creation
File Modification
DS0019 Service Service Creation
Service Modification

Monitor Launch Agent creation through additional plist files and utilities such as Objective-See’s KnockKnock application. Launch Agents also require files on disk for persistence which can also be monitored via other file monitoring applications.

Ensure Launch Agent's ProgramArguments key pointing to executables located in the /tmp or /shared folders are in alignment with enterprise policy. Ensure all Launch Agents with the RunAtLoad key set to true are in alignment with policy.

References