T1543.004 — Launch Daemon

Tactics: Persistence, Privilege Escalation · Platforms: macOS

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on…

Sub-technique of Create or Modify System Process (T1543).

Sigma detection rules (1)

T1543.004 Create or Modify System Process: Launch Daemon

title: "T1543.004 Create or Modify System Process: Launch Daemon"
id: d6f68ad9-f5c0-4c41-932b-7b56e6508798
description: 'Detection Strategy for Launch Daemon Creation or Modification (macOS). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProgramPathRegex, TimeWindow, UserContext, UnsignedBinaryFlag.'
references:
  - https://attack.mitre.org/techniques/T1543/004
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.004

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/launchctl'
  selection_args:
    CommandLine|contains: 'load'
  selection_path:
    CommandLine|contains: '/LaunchDaemons/'
  condition: selection and selection_args and selection_path

falsepositives:
  - System-wide LaunchDaemon registration is a normal part of legitimate software and security agent installation, so this should be reviewed for whether the invoking process is a recognized installer running with root privileges as expected.

level: medium

Related sub-techniques

Explore