MITRE ATT&CKsub-technique

T1543.001 Launch Agent

Published 2020-01-17 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
macOS
Version
1.5
Created
2020-01-17

Description

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents. Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks. Launch Agents can also be executed using the Launchctl command. Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true. The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1543 Create or Modify System Process technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (24)

  • S9043 Mini Shai-Hulud software (malware)
  • S9010 GlassWorm software (malware)
  • G1052 Contagious Interview group
  • S1245 InvisibleFerret software (malware)
  • S1153 Cuckoo Stealer software (malware)
  • S1048 macOS.OSAMiner software (malware)
  • S1016 MacMa software (malware)
  • S0690 Green Lambert software (malware)
  • S0595 ThiefQuest software (malware)
  • S0497 Dacls software (malware)
  • S0492 CookieMiner software (malware)
  • S0482 Bundlore software (malware)
  • S0369 CoinTicker software (malware)
  • S0352 OSX_OCEANLOTUS.D software (malware)
  • G0082 APT38 group
  • S0235 CrossRAT software (malware)
  • S0274 Calisto software (malware)
  • S0276 Keydnap software (malware)
  • S0277 FruitFly software (malware)
  • S0279 Proton software (malware)
  • S0281 Dok software (malware)
  • S0282 MacSpy software (malware)
  • S0198 NETWIRE software (malware)
  • S0162 Komplex software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-564 Run Software at Logon attack pattern

Referenced by Compliance · mitigates (8)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control

References