Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.[1][2] [3] Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.[4] Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has established persistence using InvisibleFerret malware to create file to run the script on Startup via LaunchAgents.1 Contagious Interview has also utilized a plist file located in /Library/LaunchAgents to enable a malicious bash script the ability to persist.2
All 1 groups for this technique
22 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has established persistence on macOS hosts by installing a gh-token-monitor daemon through LaunchAgent that polls GitHub every 60 seconds.1
Has established persistence on macOS via a LaunchAgent by writing a plist under /library/LaunchAgents.12
Has established persistence using LaunchAgents on macOS that run on Startup using a file named “com.avatar.update.wake.plist”.1
Can achieve persistence by creating launch agents to repeatedly execute malicious payloads.12
Has placed a Stripped Payloads with a plist extension in the Launch Agent's folder. 1
Installs a com.apple.softwareupdate.plist file in the /LaunchAgents folder with the RunAtLoad value set to true. Upon user login, MacMa is executed from /var/root/.local/softwareupdate with root privileges. Some variations also include the LimitLoadToSessionType key with the value Aqua, ensuring the MacMa only runs when there is a logged in GUI user.12
All 22 software entries for this technique · 6 newest in this preview
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1208 · macOS
Detects creation or modification of user-level Launch Agents in monitored directories using .plist files with suspicious ProgramArguments or RunAtLoad keys. Correlates file write activity with execution of launchctl or unsigned binaries invoked at login.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | fs:fsusage | write or chmod to ~/Library/LaunchAgents/*.plist |
| Service CreationDC0060 | macos:osquery | detection of new launch agents with suspicious paths or unsigned binaries |
| File ModificationDC0061 | fs:fsusage | modification of existing LaunchAgents plist |
| Command ExecutionDC0064 | macos:unifiedlog | launchctl load or boot-time plist registration |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PlistDirectoryList | Monitored directories (e.g., /Library/LaunchAgents, ~/Library/LaunchAgents) for plist drops |
| PlistKeyMonitor | Monitored keys such as RunAtLoad, KeepAlive, or ProgramArguments for policy alignment |
| ExecutablePathPattern | Patterns used to detect execution from non-standard or suspicious locations like /tmp, /var, or /Users/Shared |
| UnsignedBinaryAlert | Raise alerts if the binary referenced in the Launch Agent is unsigned or unverified |
| UserContextScope | List of users whose LaunchAgents are considered high-sensitivity (e.g., admins) |
Set group policies to restrict file permissions to the ~/launchagents folder.
Tests from Atomic Red Team (MIT licence) · technique definition
4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|