T1543.001 — Launch Agent

Tactics: Persistence, Privilege Escalation · Platforms: macOS

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in…

Sub-technique of Create or Modify System Process (T1543).

Sigma detection rules (1)

T1543.001 Create or Modify System Process: Launch Agent

title: "T1543.001 Create or Modify System Process: Launch Agent"
id: 6a169219-9873-4878-987e-d94e001e20bd
description: 'Detection of Launch Agent Creation or Modification on macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PlistDirectoryList, PlistKeyMonitor, ExecutablePathPattern, UnsignedBinaryAlert, UserContextScope.'
references:
  - https://attack.mitre.org/techniques/T1543/001
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/launchctl'
  selection_args:
    CommandLine|contains:
      - 'load'
  selection_path:
    CommandLine|contains: '/LaunchAgents/'
  condition: selection and selection_args and selection_path

falsepositives:
  - Legitimate applications register per-user LaunchAgents for update checkers and background helpers during normal installation, so this should be scoped to plists referencing unsigned binaries outside the Applications directory.

level: medium

Related sub-techniques

Explore