MITRE ATT&CKsub-technique

T1569.001 Launchctl

Published 2020-03-10 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
macOS
Version
1.3
Created
2020-03-10

Description

Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1569 System Services technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · uses (6)

  • S1153 Cuckoo Stealer software (malware)
  • S1048 macOS.OSAMiner software (malware)
  • S0658 XCSSET software (malware)
  • S0584 AppleJeus software (malware)
  • S0451 LoudMiner software (malware)
  • S0274 Calisto software (malware)

Referenced by Compliance · mitigates (8)

  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control

References