tfMITRE ATT&CK technique

Plist File Modification T1647

Tactic: Defense Impairment
Platform: macOS
Version: 2.0
Created: 09 April 2022
Last modified: 12 May 2026

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Plist File Modification MITRE reference T1647

51st pctamong all ATT&CK techniques for number of tools

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Cuckoo StealerS1153 ↗

Can create and populate property list (plist) files to enable execution.1 2

created 2024-08-20MALWARE

XCSSETS0658 ↗

In older versions, XCSSET uses the plutil command to modify the LSUIElement, DFBundleDisplayName, and CFBundleIdentifier keys in the /Contents/Info.plist file to change how XCSSET is visible on the system. In later versions, XCSSET leverages a third-party notarized dockutil tool to modify the .plist file responsible for presenting applications to the user in the Dock and LaunchPad to point to a malicious application.1 2

created 2021-10-05MALWARE

All 2 software entries for this technique

Offense vs defense T1647

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2022 Q1

Plist File Modification detection strategy DET0109

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Plist File Modification (T1647)

Enterprise

1 platform

AN0306 · macOS

Monitor for unexpected modifications of plist files in persistence or configuration directories (e.g., ~/Library/LaunchAgents, ~/Library/Preferences, /Library/LaunchDaemons). Detect when modifications are followed by execution of new or unexpected binaries. Track use of utilities such as defaults, plutil, or text editors making changes to Info.plist files. Correlate file modifications with subsequent process launches or service starts that reference the altered plist.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files
File ModificationDC0061	macos:unifiedlog	write: File modifications to *.plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories
Command ExecutionDC0064	macos:unifiedlog	exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredDirectories	Set of directories where plist modifications are considered suspicious (e.g., ~/Library/LaunchAgents, /Library/LaunchDaemons)
SuspiciousKeys	List of plist keys associated with evasion or persistence (e.g., LSUIElement, LSEnvironment, ProgramArguments)
TimeWindow	Temporal correlation window to link plist file modifications with subsequent suspicious process launches

Tests1Executorsmanual 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformsmacos

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Plist Modification	macos	manual	—	—	—
Modify MacOS plist file in one of two directories Attack command No command — this test is a manual procedure. GUID5a57f384-93b2-46a9-84c7-2201dd371624

Tests from Atomic Red Team (MIT licence) · technique definition

Plist File Modification detections T1647

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs