Sub-technique of T1543 Create or Modify System Process.View on attack.mitre.org
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.
Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path. The daemon name may be disguised by using a name from a related operating system or benign software (i.e. Masquerading). When the Launch Daemon is executed, the program inherits administrative permissions.
Additionally, system configuration changes (such as the installation of third party package managing software) may cause folders such as usr/local/bin to become globally writeable. So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.
Rules on DetectionCode tagged with T1543.004.
| Rule | Level | Log source |
|---|---|---|
| Potential Persistence Via PlistBuddy | high | macos / process_creation |
| Launch Agent/Daemon Execution Via Launchctl | medium | macos / process_creation |
None recorded.
| Used by | Procedure example |
|---|---|
| MalwareAppleJeus | AppleJeus has placed a plist file within the |
| MalwareBundlore | Bundlore can persist via a LaunchDaemon. |
| MalwareCOATHANGER | COATHANGER will create a daemon for timed check-ins with command and control infrastructure. |
| MalwareDacls | Dacls can establish persistence via a Launch Daemon. |
| MalwareGreen Lambert | Green Lambert can add a plist file in the `Library/LaunchDaemons` to establish persistence. |
| MalwareLoudMiner | LoudMiner adds plist files with the naming format |
| MalwareOSX_OCEANLOTUS.D | If running with |
| MalwareREPTILE | The REPTILE launcher can daemonize a process. |
| Used by | Procedure example |
|---|---|
| Campaign3CX Supply Chain Attack | During the 3CX Supply Chain Attack, AppleJeus installs a Launch Daemon to execute the POOLRAT macOS backdoor software. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
