T1543.001_launch-agent

T1543.001 Launch Agent

Sub-technique of: T1543

High-Level Description

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents. Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Launch Agents can also be executed using the Launchctl command.

Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true. The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: macOS

What to Check

• Identify if Launch Agent technique is applicable to target environment
• Check macOS systems for indicators of Launch Agent
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Launch Agent

Create a plist and execute it

Supported Platforms: macos Elevation Required: Yes

if [ ! -d ~/Library/LaunchAgents ]; then mkdir ~/Library/LaunchAgents; fi;
sudo cp #{path_malicious_plist} ~/Library/LaunchAgents/#{plist_filename}
sudo launchctl load -w ~/Library/LaunchAgents/#{plist_filename}

Dependencies:

• The shared library must exist on disk at specified location (#{path_malicious_plist})

Atomic Test 2: Event Monitor Daemon Persistence

This test adds persistence via a plist to execute via the macOS Event Monitor Daemon.

Supported Platforms: macos Elevation Required: Yes

sudo cp #{script_location} #{script_destination}
sudo touch /private/var/db/emondClients/#{empty_file}

Atomic Test 3: Launch Agent - Root Directory

Create a plist and execute it

Supported Platforms: macos Elevation Required: Yes

sudo cp #{path_malicious_plist} /Library/LaunchAgents/#{plist_filename}
launchctl load -w /Library/LaunchAgents/#{plist_filename}

Dependencies:

• /Library/LaunchAgents must exist
• The shared library must exist on disk at specified location (#{path_malicious_plist})

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Launch Agent by examining the target platforms (macOS).

2. Assess Existing Defenses: Review whether mitigations for T1543.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1022 Restrict File and Directory Permissions

Set group policies to restrict file permissions to the ~/launchagents folder.

Detection

Detection of Launch Agent Creation or Modification on macOS

Risk Assessment

CWE Categories

References

• AppleDocs Launch Agent Daemons
• Sofacy Komplex Trojan
• OceanLotus for OS X
• OSX Keydnap malware
• Methods of Mac Malware Persistence
• OSX Malware Detection
• Antiquated Mac Malware
• OSX.Dok Malware
• Atomic Red Team - T1543.001
• MITRE ATT&CK - T1543.001