MITRE ATT&CKsub-technique

T1543.004 Launch Daemon

Published 2020-01-17 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
macOS
Version
1.3
Created
2020-01-17

Description

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks. Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path. The daemon name may be disguised by using a name from a related operating system or benign software (i.e. Masquerading). When the Launch Daemon is executed, the program inherits administrative permissions. Additionally, system configuration changes (such as the installation of third party package managing software) may cause folders such as usr/local/bin to become globally writeable. So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1543 Create or Modify System Process technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1047 Audit mitigation
  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · uses (12)

  • C0057 3CX Supply Chain Attack campaign
  • S1219 REPTILE software (malware)
  • S1105 COATHANGER software (malware)
  • S0690 Green Lambert software (malware)
  • S0658 XCSSET software (malware)
  • S0595 ThiefQuest software (malware)
  • S0584 AppleJeus software (malware)
  • S0497 Dacls software (malware)
  • S0482 Bundlore software (malware)
  • S0451 LoudMiner software (malware)
  • S0352 OSX_OCEANLOTUS.D software (malware)
  • G0082 APT38 group

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-564 Run Software at Logon attack pattern

Referenced by Compliance · mitigates (9)

  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control

References