System Services: Launchctl
- ID
- T1569.001
- Tactics
- TA0002 Execution
- Sub-technique of
- T1569 System Services
- Platforms
- macOS
- Data sources
- Command Execution, File Modification, Process Creation, Service Creation
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.[1]
Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.[2][3]
Detection
- DET0265 Detection Strategy for System Services: Launchctl
Data components: Command Execution, File Modification, Process Creation, Service Creation
Mitigations (1)
- M1018 User Account Management
Prevent users from installing their own launch agents or launch daemons.