Launch Daemon
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The brief offers exactly one analytic (AN1126) and both of its log sources are the same object: {"product": "macos", "service": "unifiedlog"}. There is no file_event, no process_creation and no osquery source anywhere in this brief, so the observable the technique actually turns on — a.plist created or modified under /Library/LaunchDaemons/ or /System/Library/LaunchDaemons/ with a Program or ProgramArguments path — has no log source here that carries a filename field at all. macos/unifiedlog is not in Sigma's logsource taxonomy and has no standardised field names: this repository's own mapping layer has no macOS entry (grep for 'macos' across lib/ returns nothing), and lib/sigma/translate.ts emits no macOS field mapping for any of the four backends. […]
What the technique is
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks. Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path. The daemon name may be disguised by using a name from a related operating system or benign software (i.e. Masquerading). When the Launch Daemon is executed, the program inherits administrative permissions. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1126
Creation or modification of.plist files in /Library/LaunchDaemons/, especially those with suspicious Program or ProgramArguments paths, combined with execution activity under launchd with elevated privileges. Detectable through correlated Unified Logs, file monitoring, and process telemetry.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.