LoFP / legitimate administration activities is expected to trigger false positives. investigate the command line being passed to determine if the service or launch agent are suspicious.

Techniques

• t1543
• t1543.001
• t1543.004
• t1569
• t1569.001

Sample rules

Launch Agent/Daemon Execution Via Launchctl

• source: sigma
• technicques:
  • t1543
  • t1543.001
  • t1543.004
  • t1569
  • t1569.001

Description

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Detection logic

condition: selection
selection:
  CommandLine|contains:
  - submit
  - load
  - start
  Image|endswith: /launchctl