Procedure examples

ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.

Bundlore can persist via a LaunchAgent.

GlassWorm has established persistence on macOS via a LaunchAgent by writing a plist under `/library/LaunchAgents`.

CrossRAT creates a Launch Agent on macOS.

OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.

Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.

MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user.

Proton persists via Launch Agent.

CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.

CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.

The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.

Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format com.random.name.plist.

MacSpy persists via a Launch Agent.

Mini Shai-Hulud has established persistence on macOS hosts by installing a gh-token-monitor daemon through LaunchAgent that polls GitHub every 60 seconds.

During the 2022 Ukraine Electric Power Attack, Sandworm Team configured Systemd to maintain persistence of GOGETTER, specifying the `WantedBy=multi-user.target` configuration to run GOGETTER when the system begins accepting user logins.

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.

Rocke has installed a systemd service script to maintain persistence.

Scattered Spider has run `SYSTEMD_UNIT_PATH="/lib/systemd/
system/teleport.service` to establish persistence for the Teleport remote access tool.

Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.service` file under the `/lib/systemd/system/` folder.

Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.

Gomir creates a systemd service named `syslogd` for persistence.

Hildegard has started a monero service.

Fysbis has established persistence using a systemd service.

SysUpdate can copy a script to the user owned `/usr/lib/systemd/system/` directory with a symlink mapped to a `root` owned directory, `/etc/ystem/system`, in the unit configuration file's `ExecStart` directive to establish persistence and elevate privileges.

RIFLESPINE can create a systemd service file for execution.

Shai-Hulud has stopped `systemd-resolved` in order to manipulate DNS and firewalls.

Pupy can be used to establish persistence using a systemd service.

TeamPCP Cloud Stealer can create a systemd unit to execute a python script for persistence.

Mini Shai-Hulud has created .service files using Systemd on victim Linux hosts to establish persistence.

TeamPCP has used the systemd user service for malware persistence in targeted environments.

During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.

During Operation Digital Eye, threat actors created a service named Visual Studio Code Service to run Visual Studio code.

During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN.

APT38 has installed a new Windows service to establish persistence.

BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines.

APT3 has a tool that creates a new service for persistence.

Kimsuky has created new services for persistence.

APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.

APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.

TeamTNT has used malware that adds cryptocurrency miners as a service.

FIN7 created new Windows services and added them to the startup directories for persistence.

OilRig has used a compromised Domain Controller to create a service on a remote host.

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.

Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.

Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.

DarkVishnya created new services for shellcode loaders distribution.