Inspect macOS Persistence
Overview
Inventory registered and file-backed persistence, then correlate it with loaded runtime state and installation history. Read files and official service state; never manage launchd by editing its internal state.
Read references/macos-persistence-surfaces.md for prioritized surfaces and evidence fields.
Workflow
- Record host/build, user domains, event timeline, and the suspected executable or label.
- Record whether the system is a physical Mac or macOS guest, plus the guest's restore image/build, VM tool/framework, integrations, baseline/reset state, and known virtualization artifacts.
- Inventory user-visible registrations.
- Review Login Items and background-item state, profiles, extensions, browser add-ons, and app-managed helpers.
- Inventory launch services.
- Inspect user/system LaunchAgents and LaunchDaemons as files and query service state through
launchctl read operations.
- Record label, domain, program/arguments, working directory, environment, sockets, keep-alive/start conditions, owner/permissions, signer, and loaded PID/status.
- Inspect adjacent persistence.
- Review shell startup files, scheduled jobs, package receipts/scripts, privileged helpers, system/network extensions, authorization plugins, and current platform-specific surfaces justified by evidence.
- Correlate provenance and runtime.
- Identify parent installer/app, creation/change time, signature/notarization, executable hash, running process ancestry, files, network, and logs.
- Classify each item.
- Expected, suspicious, confirmed malicious, disabled/orphaned, or unresolved; explain evidence and impact.
- Keep guest-observed persistence distinct from physical-host proof when anti-VM, hardware, recoveryOS, kernel/system-extension, or device behavior may differ.
- Preserve before containment.
- Record files and service state before using official
launchctl bootout or app/uninstaller paths in the containment workflow.
Output
Return a persistence inventory, loaded-versus-file state, provenance, runtime correlation, classification/confidence, and safe containment handoff.
1---2name: inspect-macos-persistence3description: Inspect macOS persistence and recurring execution without deleting evidence. Use for login items, launch agents or daemons, extensions, profiles, shell startup files, scheduled tasks, browser extensions, helpers, and startup behavior.4---56# Inspect macOS Persistence78## Overview910Inventory registered and file-backed persistence, then correlate it with loaded runtime state and installation history. Read files and official service state; never manage launchd by editing its internal state.1112Read [references/macos-persistence-surfaces.md](references/macos-persistence-surfaces.md) for prioritized surfaces and evidence fields.1314## Workflow15161. Record host/build, user domains, event timeline, and the suspected executable or label.17 - Record whether the system is a physical Mac or macOS guest, plus the guest's restore image/build, VM tool/framework, integrations, baseline/reset state, and known virtualization artifacts.182. Inventory user-visible registrations.19 - Review Login Items and background-item state, profiles, extensions, browser add-ons, and app-managed helpers.203. Inventory launch services.21 - Inspect user/system LaunchAgents and LaunchDaemons as files and query service state through `launchctl` read operations.22 - Record label, domain, program/arguments, working directory, environment, sockets, keep-alive/start conditions, owner/permissions, signer, and loaded PID/status.234. Inspect adjacent persistence.24 - Review shell startup files, scheduled jobs, package receipts/scripts, privileged helpers, system/network extensions, authorization plugins, and current platform-specific surfaces justified by evidence.255. Correlate provenance and runtime.26 - Identify parent installer/app, creation/change time, signature/notarization, executable hash, running process ancestry, files, network, and logs.276. Classify each item.28 - Expected, suspicious, confirmed malicious, disabled/orphaned, or unresolved; explain evidence and impact.29 - Keep guest-observed persistence distinct from physical-host proof when anti-VM, hardware, recoveryOS, kernel/system-extension, or device behavior may differ.307. Preserve before containment.31 - Record files and service state before using official `launchctl bootout` or app/uninstaller paths in the containment workflow.3233## Output3435Return a persistence inventory, loaded-versus-file state, provenance, runtime correlation, classification/confidence, and safe containment handoff.
gaelic-ghost