CyberStack

MITRE ATT&CK / Techniques / T1543.001

Create or Modify System Process: Launch Agent

ID
T1543.001
Tactics
TA0003 Persistence, TA0004 Privilege Escalation
Sub-technique of
T1543 Create or Modify System Process
Platforms
macOS
Data sources
Command Execution, File Creation, File Modification, Service Creation
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.[2][3] [4] Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.[5] Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Launch Agents can also be executed using the Launchctl command.

Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.[6][7] The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.[8][9]

Detection

Mitigations (1)

M1022 Restrict File and Directory Permissions

Set group policies to restrict file permissions to the ~/launchagents folder.[1]

Groups (2)

Software (22)

References

  1. piazza launch agent mitigation
  2. AppleDocs Launch Agent Daemons
  3. OSX Keydnap malware
  4. Antiquated Mac Malware
  5. OSX.Dok Malware
  6. Sofacy Komplex Trojan
  7. Methods of Mac Malware Persistence
  8. OSX Malware Detection
  9. OceanLotus for OS X