tfMITRE ATT&CK sub-technique

Launch Daemon T1543.004

sub-technique of T1543 Create or Modify System Process

Tactics: Persistence, Privilege Escalation
Platform: macOS
Version: 1.3
Created: 17 January 2020
Last modified: 24 October 2025

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.[1][2][3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware74th pct

Tools & malware74th percentile · 74% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Launch Daemon MITRE reference T1543.004

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

3CX Supply Chain AttackC0057 ↗

During the 3CX Supply Chain Attack, AppleJeus installs a Launch Daemon to execute the POOLRAT macOS backdoor software.1

2022–2023

All 1 campaigns for this technique

10 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

REPTILES1219 ↗

The REPTILE launcher can daemonize a process.1

created 2025-06-09MALWAREcarried by 1 group

COATHANGERS1105 ↗

Will create a daemon for timed check-ins with command and control infrastructure.1

created 2024-02-07MALWARE

Green LambertS0690 ↗

Can add a plist file in the Library/LaunchDaemons to establish persistence.1 2

created 2022-03-21MALWARE

XCSSETS0658 ↗

Uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.1

created 2021-10-05MALWARE

ThiefQuestS0595 ↗

When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the /Library/LaunchDaemons/ folder with the RunAtLoad key set to true establishing persistence as a Launch Daemon. 1

created 2021-03-19MALWARE

AppleJeusS0584 ↗

Has placed a plist file within the LaunchDaemons folder and launched it manually.1 2

created 2021-03-01MALWAREcarried by 1 group

All 10 software entries for this technique · 6 newest in this preview

Offense vs defense T1543.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0

first rule: 2023 Q1 · 1 of 1 campaigns plotted

Launch Daemon detection strategy DET0401

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Launch Daemon Creation or Modification (macOS)

Enterprise

1 platform

AN1126 · macOS

Creation or modification of .plist files in /Library/LaunchDaemons/, especially those with suspicious Program or ProgramArguments paths, combined with execution activity under launchd with elevated privileges. Detectable through correlated Unified Logs, file monitoring, and process telemetry.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	launchd spawning processes tied to new or modified LaunchDaemon .plist entries
File CreationDC0039	fs:launchdaemons	file_create
Service CreationDC0060	macos:unifiedlog	launchd loading new LaunchDaemon or changes to existing daemon configuration
File ModificationDC0061	fs:launchdaemons	file_modify

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProgramPathRegex	Regex patterns to match anomalous executable paths or names in .plist files
TimeWindow	Correlation window between file modification and launchd process execution
UserContext	Admin or root context used during daemon installation
UnsignedBinaryFlag	Whether the binary associated with the LaunchDaemon is signed or trusted

Tests1Executorsbash 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformsmacos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Launch Daemon macos bash Required 1 Yes

Utilize LaunchDaemon to launch Hello World

Input arguments

Name	Type	Default	Description
plist_filename	string	com.atomicredteam.plist	filename
path_malicious_plist	string	$PathToAtomicsFolder/T1543.004/src/atomicredteam_T1543_004.plist	Name of file to store in cron folder

Attack command

sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename}
sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename}

Cleanup command

sudo launchctl unload /Library/LaunchDaemons/#{plist_filename}
sudo rm /Library/LaunchDaemons/#{plist_filename}
sudo rm /tmp/T1543_004_atomicredteam.txt

Prerequisite

The shared library must exist on disk at specified location (#{path_malicious_plist})

Check

if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi;

Satisfy

echo "The plist file doesn't exist. Check the path and try again."; exit 1;

GUID18e093e0-ad59-4aa5-bdba-fcd56ce36640

Tests from Atomic Red Team (MIT licence) · technique definition

Launch Daemon detections T1543.004

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs