T1546.014 — Emond

Tactics: Privilege Escalation, Persistence · Platforms: macOS

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a Launch Daemon that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.014 Event Triggered Execution: Emond

title: "T1546.014 Event Triggered Execution: Emond"
id: ef6e8ea1-8777-494a-9a6a-7326521cb1dc
description: 'Detection Strategy for Event Triggered Execution via emond on macOS. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PathPrefix, TimeWindow, ParentProcessFilter, CommandPatternList.'
references:
  - https://attack.mitre.org/techniques/T1546/014
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.014

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains: '/etc/emond.d/rules/'
  selection_ext:
    TargetFilename|endswith: '.plist'
  condition: selection and selection_ext

falsepositives:
  - The emond mechanism has been deprecated since macOS Big Sur and is rarely used legitimately, so a new rule file in /etc/emond.d/rules/ should be treated with high suspicion and this pattern has very few known benign sources.

level: high

Related sub-techniques

Explore