T1647 — Plist File Modification

Tactic: Defense Impairment · Platforms: macOS

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating…

Sigma detection rules (1)

T1647 Plist File Modification

title: T1647 Plist File Modification
id: 984c8008-f823-4cfd-b500-0e09e9a78e97
description: 'Detection Strategy for Plist File Modification (T1647). (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredDirectories, SuspiciousKeys, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1647
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1647

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
    TargetFilename|endswith: '.plist'
  filter:
    TargetFilename|contains: '/Library/LaunchDaemons/com.apple.'

  condition: selection and not filter

falsepositives:
  - Legitimate third-party software installers routinely create or update their own LaunchAgent or LaunchDaemon plist files during install and update.

level: medium

Explore