Procedure examples

COATHANGER will create a daemon for timed check-ins with command and control infrastructure.

Dacls can establish persistence via a Launch Daemon.

The REPTILE launcher can daemonize a process.

Green Lambert can add a plist file in the `Library/LaunchDaemons` to establish persistence.

When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the /Library/LaunchDaemons/ folder with the RunAtLoad key set to true establishing persistence as a Launch Daemon.

Bundlore can persist via a LaunchDaemon.

If running with root permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchDaemons.

XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.

AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.

LoudMiner adds plist files with the naming format com.[random_name].plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.