Query: detect Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS. in logs
Matching passage: Sigma rule: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.. Logsource: macos / process_creation. Rule: title: Launch Agent/Daemon Execution Via Launchctl id: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e status: test description: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/ - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/ - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html - https://www.loobins.io/binaries/launchctl/ author: Pratinav Chandra date: 2024-05-13 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1569.001 - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /launchctl CommandLine|contains: - submit - load - start condition: selection falsepositives: - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious. level: medium
Near-miss passage: Sigma rule: Detects potential PowerShell commands or code within registry run keys. Logsource: windows / registry_set. Rule: title: Suspicious PowerShell In Registry Run Keys id: 8d85cf08-bf97-4260-ba49-986a2a65129c status: test description: Detects potential PowerShell commands or code within registry run keys references: - https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: frack113, Florian Roth (Nextron Systems) date: 2022-03-17 modified: 2025-07-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Details|contains: - powershell - 'pwsh ' - FromBase64String - .DownloadFile( - .DownloadString( - ' -w hidden ' - ' -w 1 ' - -windowstyle hidden - -window hidden - ' -nop ' - ' -encodedcommand ' - -ExecutionPolicy Bypass - Invoke-Expression - IEX ( - Invoke-Command - ICM - - Invoke-WebRequest - 'IWR ' - Invoke-RestMethod - 'IRM ' - ' -noni ' - ' -noninteractive ' condition: selection falsepositives: - Legitimate admin or third party scripts. Baseline according to your environment level: medium