1. Home
  2. Techniques
  3. Enterprise
  4. System Services
  5. Launchctl

System Services: Launchctl

ID Name
T1569.001 Launchctl
T1569.002 Service Execution

Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.[1]

Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.[2][3]

ID: T1569.001
Sub-technique of:  T1569
ⓘ
Tactic: Execution
ⓘ
Platforms: macOS
Version: 1.2
Created: 10 March 2020
Last Modified: 20 September 2024
Version Permalink

Procedure Examples

ID Name Description
S0584 AppleJeus

AppleJeus has loaded a plist file using the launchctl command.[4]
S0274 Calisto

Calisto uses launchctl to enable screen sharing on the victim’s machine.[5]
S1153 Cuckoo Stealer

Cuckoo Stealer can use launchctl to load a LaunchAgent for persistence.[6]
S0451 LoudMiner

LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl. It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.[7]

S1048 macOS.OSAMiner

macOS.OSAMiner has used launchctl to restart the Launch Agent.[8]
S0658 XCSSET

XCSSET loads a system level launchdaemon using the launchctl load -w command from /System/Librarby/LaunchDaemons/ssh.plist.[9]

Mitigations

ID Mitigation Description
M1018 User Account Management

Prevent users from installing their own launch agents or launch daemons.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor the execution of the launchctl command, focusing on subcommands such as load, unload, and start that may be used by adversaries to load Launch Agents or Launch Daemons.

Note: This analytic monitors the execution of the launchctl command and its key subcommands. Exclude known administrative users to minimize false positives.

Analytic 1 - Suspicious Launchctl

sourcetype=macOS:unified OR sourcetype=osquery OR sourcetype=auditd| search command IN ("launchctl load", "launchctl unload", "launchctl start")

DS0022 File File Modification

Every Launch Agent and Launch Daemon must have a corresponding plist file on disk which can be monitored. Plist files are located in the root, system, and users /Library/LaunchAgents or /Library/LaunchDaemons folders. Launch Agent or Launch Daemon with executable paths pointing to /tmp and /Shared folders locations are potentially suspicious.

Analytic 1 - Suspicious plist file modifications.

sourcetype=osquery OR sourcetype=FSEvents| search file_path IN ("/Library/LaunchAgents/", "/Library/LaunchDaemons/")| where file_action="modified" AND new_executable_path IN ("/tmp/", "/Shared/")

DS0009 Process Process Creation

Monitor for newly executed daemons that may abuse launchctl to execute commands or programs.

Analytic 1 - Executable path is in unusual directories

sourcetype=osquery OR sourcetype=auditd| search parent_process="launchctl" AND process_path IN ("/tmp/", "/Shared/")

DS0019 Service Service Creation

Monitor the creation or modification of Launch Agents or Launch Daemons via the launchctl command.

Analytic 1 - Create Service In Suspicious File Path

sourcetype=osquery| search service_action="create" OR service_action="modify"| where user NOT IN ("known_admins") AND service_name IN ("LaunchAgents", "LaunchDaemons")

References

  1. SS64. (n.d.). launchctl. Retrieved March 28, 2020.
  2. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
  3. Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
  4. Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.
  5. Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.
  1. Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.
  2. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.
  3. Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.
  4. Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.