tfMITRE ATT&CK technique

Plist File Modification T1647

Tactic: Defense Impairment
Platform: macOS
Version: 2.0
Created: 09 April 2022
Last modified: 12 May 2026

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 44% of ATT&CK techniques have fewer tools implementing them.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Offense vs defense T1647

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files
File ModificationDC0061	macos:unifiedlog	write: File modifications to *.plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories
Command ExecutionDC0064	macos:unifiedlog	exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys

Data component

Name

Channel

Process CreationDC0032

macos:unifiedlog

exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files

File ModificationDC0061

macos:unifiedlog

write: File modifications to *.plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories

Command ExecutionDC0064

macos:unifiedlog

exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys

Field	What you tune
MonitoredDirectories	Set of directories where plist modifications are considered suspicious (e.g., ~/Library/LaunchAgents, /Library/LaunchDaemons)
SuspiciousKeys	List of plist keys associated with evasion or persistence (e.g., LSUIElement, LSEnvironment, ProgramArguments)
TimeWindow	Temporal correlation window to link plist file modifications with subsequent suspicious process launches

Field

What you tune

MonitoredDirectories

Set of directories where plist modifications are considered suspicious (e.g., ~/Library/LaunchAgents, /Library/LaunchDaemons)

SuspiciousKeys

List of plist keys associated with evasion or persistence (e.g., LSUIElement, LSEnvironment, ProgramArguments)

TimeWindow

Temporal correlation window to link plist file modifications with subsequent suspicious process launches

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Plist Modification	macos	manual	—	—	—
Modify MacOS plist file in one of two directories Run it with these steps 1. Modify a .plist in /Library/Preferences OR ~/Library/Preferences 2. Subsequently, follow the steps for adding and running via [Launch Agent](Persistence/Launch_Agent.md) GUID394a538e-09bb-4a4a-95d1-b93cf12682a8

Offense vs defense T1647

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files
File ModificationDC0061	macos:unifiedlog	write: File modifications to *.plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories
Command ExecutionDC0064	macos:unifiedlog	exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys

Data component

Name

Channel

Process CreationDC0032

macos:unifiedlog

exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files

File ModificationDC0061

macos:unifiedlog

write: File modifications to *.plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories

Command ExecutionDC0064

macos:unifiedlog

exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys

Field	What you tune
MonitoredDirectories	Set of directories where plist modifications are considered suspicious (e.g., ~/Library/LaunchAgents, /Library/LaunchDaemons)
SuspiciousKeys	List of plist keys associated with evasion or persistence (e.g., LSUIElement, LSEnvironment, ProgramArguments)
TimeWindow	Temporal correlation window to link plist file modifications with subsequent suspicious process launches

Field

What you tune

MonitoredDirectories

Set of directories where plist modifications are considered suspicious (e.g., ~/Library/LaunchAgents, /Library/LaunchDaemons)

SuspiciousKeys

List of plist keys associated with evasion or persistence (e.g., LSUIElement, LSEnvironment, ProgramArguments)

TimeWindow

Temporal correlation window to link plist file modifications with subsequent suspicious process launches

Plist File Modification T1647

Plist File Modification T1647

Plist File Modification MITRE reference T1647

Offense vs defense T1647

Plist File Modification detection strategy DET0109

Detection Strategy for Plist File Modification (T1647)

Log sources

Tunable fields

Plist File Modification MITRE reference T1647

Offense vs defense T1647

Plist File Modification detection strategy DET0109

Detection Strategy for Plist File Modification (T1647)

Log sources

Tunable fields

Plist File Modification detections T1647

Plist File Modification detections T1647