T1569.001 — Launchctl

Tactic: Execution · Platforms: macOS

Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. Adversaries use launchctl to execute…

Sub-technique of System Services (T1569).

Sigma detection rules (1)

T1569.001 System Services: Launchctl

title: "T1569.001 System Services: Launchctl"
id: f6d697b2-5f13-41db-97a1-09d7f05805d9
description: 'Detection Strategy for System Services: Launchctl. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredPaths, SuspiciousExecPaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1569/001
author: Shahrukh Khan
date: 2026-01-27
license: MIT
tags:
  - attack.execution
  - attack.t1569.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/launchctl'
    CommandLine|contains|all:
      - 'load'
      - '-w'

  condition: selection

falsepositives:
  - IT deployment scripts that load and enable a legitimate LaunchAgent or LaunchDaemon as part of standard software packaging.

level: medium

Related sub-techniques

Explore