Launch Agent/Daemon Execution Via Launchctl

Rule Info

Name
Launch Agent/Daemon Execution Via Launchctl
Author
Pratinav Chandra
Description
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
Reference
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md
Date
2024-05-13 00:00:00
Modified
None
Id
ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
Tags
attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
pratinavchandra
Merge PR #4782 from @pratinavchandra - Add `Launch Agent/Daemon Execution Via Launchctl`
2024-05-13
2837671f3
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022